Spyware
SpyPress
According to ESET, SpyPress is a set of Javascript payloads targeting different webmail frameworks (HORDE, MDAEMON, ROUNDCUBE, ZIMBRA).
SpyPress is a JavaScript spyware operated by APT28.
Background
ESET reports that SpyPress is a collection of JavaScript payloads aimed at several webmail platforms (HORDE, MDAEMON, ROUNDCUBE, ZIMBRA). These payloads share several traits. Each is obfuscated in the same manner, with variable and function names swapped for random-looking strings. The strings the code relies on, including webmail and C&C server URLs, are likewise obfuscated and kept in an encrypted list, with each entry decrypted only at the moment it is needed. Because the variable and function names are randomized per sample, the resulting SpyPress payloads end up with different hashes. They also lack any persistence or update functionality; the payload lives entirely inside the email and runs only when the message is opened in a vulnerable webmail instance.
In every case the payloads reach their hardcoded C&C servers over HTTP POST requests. Only a handful of C&C servers exist, and they are shared across all payloads with no distinction by victim or payload type.
Source: Malpedia (Fraunhofer FKIE).