May 19th, 2025

Cyber Mornings Daily · May 19, 2025 · 11m

One source details a global cyberespionage campaign called 'RoundPress', attributed with medium confidence to the Russian state-sponsored hackers APT28. This campaign targeted government webmail servers in various countries by exploiting XSS vulnerabilities in products like Roundcube, Horde, MDaemon, and Zimbra to steal credentials and email content. Another source describes a new tool named 'Defendnot' that can disable Microsoft Defender on Windows devices. This tool functions by registering a fake antivirus product using an undocumented Windows Security Center API and injecting a DLL into a…