Body: HTML @import tag-splitting XSS — RoundPress/ZimReaper webmail exploit delivery

[yana-ivanov]

Description

Detects emails containing the @import tag-splitting obfuscation technique used by TA458 (Operation RoundPress/SpyPress) and TA488 (Void Blizzard/ZimReaper) to deliver cross-site scripting exploits against self-hosted webmail platforms including Zimbra, Roundcube, mDaemon, SOGo, and Kerio.

Opening the email in a vulnerable webmail client is sufficient to trigger execution — no link click or attachment required (half-click exploit). Active campaigns disclosed jointly by Proofpoint, NSA, and FBI on July 23, 2026.

Coverage gap: body_cve_2023_5631.yml covers a specific Roundcube CVE signature. This rule targets the generic @import tag-splitting obfuscation technique and known ZimReaper payload markers across all targeted platforms.

Associated samples

• https://yanaivanov.com/analysis/roundpress_analysis.html
• https://www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits

[github-actions]

Shared Samples Sync - Action Required

This PR was not automatically synced to shared-samples because the author is not a member of the sublime-security organization.

To enable syncing, an organization member can comment /update-shared-samples on this PR.

Once triggered, the rules will be synced on the next scheduled run (every 10 minutes).