FANCYBEAR EXPOSED: MAJOR OPSEC BLUNDER INSIDE RUSSIAN ESPIONAGE OPS

Summary from the TLDR InfoSec newsletter

An OPSEC failure on a NameCheap VPS exposed FancyBear/APT28's active C2 infrastructure, revealing a modular webmail exploitation toolkit targeting Roundcube and SquirrelMail via XSS to silently exfiltrate 2,800+ emails, steal 240+ credential sets including TOTP secrets, and deploy 140+ persistent Sieve forwarding rules redirecting all incoming mail to advenwolf@proton[.]me — all triggered without victim interaction beyond opening a spearphishing email. The exposed open directory on port 8889 contained server-side C2 source code, full telemetry logs, and lure PDFs targeting Ukrainian prosecutors, the Romanian Air Force, the Greek GEETHA, and the Serbian MoD across six countries. Defenders should audit Roundcube and SquirrelMail instances for unauthorized Sieve rules, block zhblz[.]com and 203.161.50[.]145, rotate credentials and TOTP secrets for any organization in the victimology, and disable ManageSieve where not operationally required.