Η Fancy Bear Χτυπά την Ελλάδα: Ρωσική Κατασκοπεία Παραβίασε το ΓΕΕΘΑ

New research reveals that the Russian group APT28/Fancy Bear breached the (GHNDGreek General Staff of National Defense ) — along with government and military entities from six other countries. The operation ran for over 500 days, even bypassing two-factor authentication (2FA), and is still operating even after its C2 server was publicly disclosed.

1. The Context: What Was Revealed and When

On March 11, 2026, threat intelligence firm Hunt.io published the results of its investigation into a campaign cyberespionage it is tracking codenamed “Operation Roundish.” The trigger was an exposed open-directory server that was first scanned by the Censys on January 13, 2026.

A few days later, researchers from Ctrl-Alt-Intel discovered a second exposed directory on the same server — one that the Hunt.io archive had not captured. This second directory contained something much more sensitive: the full C2 source code , additional JavaScript payloads , campaign telemetry logs , and extracted data that provided a near-complete picture of the entire operation.

CERT-UA had already linked the IP address 203.161.50[.]145 to APT28 activity in two separate alerts from 2024: first, in CERT-UA#10859 concerning exploit Roundcube (CVE-2023-43770), and second, in the ClickFix/fake reCAPTCHA. However, Fancy Bear continued to operate from the same server for over 500 days.

See also: APT28 spies on the Ukrainian military with BEARDSHELL and COVENANT

2. Who Are Fancy Bear / APT28?

2.1 History and Mission

Fancy Bear has been active since 2004, although some researchers have traced its activity back to the late 1990s. The group is not just a hacking group — it is an official branch of the Russian state apparatus, specifically Unit 26165 of the GRU.

Their primary goal is to gather strategic intelligence that serves the interests of the Russian government. This means targeting governments, military organizations, think tanks, journalists, and organizations involved in Western policymaking — particularly with regard to Russia, Ukraine, and NATO.

2.2 High-Profile Historical Operations

Fancy Bear has left an impressive trail of international cyberespionage over the past two decades:

• 2016 — US Elections: The Democratic National Committee (DNC) was hacked and 19,252 emails were stolen. This incident brought them to the global spotlight.
• 2016 — WADA / Olympic Games: Breach of WADA's ADAMS database and publication of athletes' medical records (Simone Biles, Venus & Serena Williams) via the website fancybear.net.
• 2015 — French TV5Monde: Termination of broadcasts and "false flag" attack attributed to ISIS, later proven to be the work of APT28.
• 2017 — German Parliament (Bundestag): Intrusion into parliament's networks and theft of confidential documents.
• 2020-2024 — Extensive operations against NATO and Ukrainian governments.
• 2024 — CVE-2023-43770 (Roundcube XSS) against Ukrainian organizations — the beginning of today's campaign.
• 2026 — The current campaign with casualties in the Hellenic National Defense General Staff and other Balkan/NATO.

3. The Infrastructure: The Server They Left Open

3.1 The OPSEC Mistake — What is an “Open Directory”?

When an attacker needs to transfer files to a compromised system, the simplest technical means is to open an HTTP file server on their machine and let the victim "download" the payload. This is usually done with a command as simple as:

The problem: this server has no authentication, no encryption, and if directory listing is not disabled, anyone who knows the IP address can see — and download — everything.

That's exactly what happened with Fancy Bear. They opened HTTP servers on port 8889 on VPS 203.161.50[.]145 (Namecheap, USA) and forgot to close them. Censys, a company that systematically scans the internet for open ports, discovered and archived them.

3.2 Exhibition Timeline

Censys Service History reveals that one of the exposed directories was open between January 31, 2026 (12:14 UTC) and March 11, 2026 (10:02 UTC). Hunt.io archived a different directory on January 13, 2026. Ctrl-Alt-Intel discovered a third directory with even more sensitive content.

3.3 What the Exposed Directory Contained

The directory discovered by Ctrl-Alt-Intel contained:

• Complete C2 (Command & Control infrastructure) source code
• JavaScript payloads for Roundcube and SquirrelMail
• Telemetry logs — records of each successful or failed payload execution
• Exfiltrated data — stolen emails, credentials, TOTP secrets
• Cloned Roundcube login pages for credential harvesting
• url.txt files — the “backbone” of telemetry, which recorded every XSS payload execution

See also: Ukraine: APT28 installs BadPaw Loader and MeowMeow Backdoor

4. Technical Analysis: How the Attack Works

4.1 Phase 1 — Spear Phishing with ClickFix / Fake reCAPTCHA

The attack chain begins with a spear phishing email sent to targeted individuals in government and military organizations. The email contains a link to a domain that quite convincingly mimics Google Docs:

Once the user visits the link, a fake reCAPTCHA verification page — a well-known PoC (Proof of Concept) by researcher John Hammond. This technique, known as “ClickFix,” tricks the user into executing commands on their computer by delivering Metasploit payloads. The C2 server is always 203.161.50[.]145.

4.2 Phase 2 — XSS Injection in Webmail

Alongside the ClickFix vector, Fancy Bear exploits the CVE-2023-43770 in Roundcube Webmail — a Cross-Site Scripting (XSS) vulnerability that allows arbitrary JavaScript code to be executed within the victim's browser, within the context of an already authenticated webmail session.

Ctrl-Alt-Intel also documented a previously unreported variant targeting SquirrelMail — an older but still widely used webmail system. Cloned Roundcube login pages for direct credential harvesting were also found on the exposed server .

4.3 Phase 3 — Payload Execution (worker.js family)

Once the XSS is executed, the main payload, known as the “worker.js family” — a family of JavaScript files that executes entirely within the browser, without requiring anything to be installed on the system — is loaded into the victim's browser.

worker.js can silently execute the following:

• User Identification: Identifies the victim's logged-in username and email
• Credential theft: Steals passwords through hidden auto-fill forms and click-based exfiltration
• Bulk email exfiltration: Bulk extracts entire Inbox and Sent folders as .eml files
• Modular extension: Loads additional modules for forwarding rules, address book theft and TOTP extraction
• Telemetry: Records every execution in the C2 url.txt file via GET requests to zhblz.com

4.4 Phase 4 — Bypassing 2FA: The keyTwoAuth.js Module

This is perhaps the most technically worrying finding of the research. Fancy Bear developed a special module, keyTwoAuth.js, to extract TOTP-based 2FA secrets directly from the victim's browser session.

Ctrl-Alt-Intel recovered 516 log entries with the prefix "ktfu" from 108 unique victim addresses:

• 256 accounts: Successful theft of real TOTP secrets — targets Romanian Air Force, Defense General Staff Greek National, Ukrainian Asset Recovery Service, Serbian Ministry of Defense
• 260 accounts: Returned “nokey” — these accounts had no 2FA configured at all, making them even easier targets

4.5 Phase 5 — Permanent Presence: addRedirectMailBox.js

Along with the data extraction, APT28 installed a persistent access mechanism via the addRedirectMailBox.js module. This module abused the ManageSieve of Roundcube — an automated email management system — to create a Sieve rule that silently copied EVERY incoming email to a ProtonMail account under the attackers’ control.

The crucial element: this rule remained active even if:

• The victim was changing his password
• The original XSS vulnerability was being closed/fixed
• 2FA was activated retrospectively

Researchers found that the rules often had names that resembled legitimate system rules, such as "SystemProtect" or "SystemHealthChek" — apparently to avoid detection by administrators who control Sieve rules.

See also: APT28 linked to MSHTML zero-day ahead of February Patch Tuesday

5. The Victims: What Was Stolen, Who Was Hit?

5.1 Campaign Statistics

5.2 Target Countries and Organizations

The victims are spread across six countries, with a clear geopolitical pattern:

Greece — The Most Disturbing Finding for Us

Confirmed breach of the General Staff of National Defense (GHND). Ctrl-Alt-Intel recovered emails and TOTP secrets from accounts associated with the GHND. The Greek participation was not accidental:

• Training Ukrainian F-16 pilots: Greece participated in the F-16 training program for Ukraine, making it a militarily sensitive target for Russia
• Military mobility agreement: In July 2024, Greece, Romania, and Bulgaria signed a military mobility agreement — a signal to Russia that the region is coordinating militarily
• NATO member: As a NATO member, Greece has access to classified information of interest to Russian espionage.

Ukraine

The largest group of victims, with a focus on regional prosecutors — likely those handling war crimes investigations. Also a victim is the Asset Recovery Service. This is part of the Russian strategy to address war crimes legal proceedings.

Romania

Air Force Violation . Romania hosts NATO installations, has direct access to the Black Sea, and is actively involved in military support of Ukraine.

Bulgaria, Serbia, North Macedonia

Government entities and the Ministry of Defense of Serbia. All three countries are in a geostrategically sensitive position in the Balkans.

NATO Headquarters

Particularly worrying: Ctrl-Alt-Intel found email addresses linked to four NATO member states — including the very infrastructure of NATO Headquarters — in the stolen contact data.

6. Geopolitical Analysis: The Logic of Targeting

The choice of victims is not accidental — it is the outward expression of Russian strategic priorities in the context of the war in Ukraine:

6.1 Mapping Western Military Support

The researchers' main working hypothesis is that APT28 seeks to obtain information about the manner, type and volume of military assistance provided to Ukraine by Western countries. All targeted countries (Greece, Romania, Bulgaria, Serbia, North Macedonia) are in regional military relevance to the Ukrainian front.

6.2 Monitoring War Crimes Investigations

The focus on Ukrainian regional prosecutors is indicative: Russia is keenly interested in monitoring legal proceedings that collect evidence of war crimes. Knowing what the prosecutors know, it can react in advance.

6.3 Preventing NATO Coordination

The breach of the Serbian General Staff and Ministry of Defense also suggests a possible attempt to understand the level of NATO-coordination in the Balkans — a region where Russia traditionally maintains influence (particularly in Serbia).

See also: APT28 targets Europe with webhook-based macro malware

7. Indicators of Compromise (IOCs) — Technical Details

The following IOCs were published by Ctrl-Alt-Intel and can be used directly for threat hunting:

7.1 Network IOCs

7.2 File / Payload IOCs

7.3 Vulnerabilities Exploited

8. Comparison with “Operation RoundPress” (ESET)

Prior to the current report, ESET had published findings on a similar APT28 campaign it dubbed “Operation RoundPress.” The comparison reveals significant commonalities:

9. What Greek Organizations Should Do Now

The following measures are addressed to Greek government, military, and operationally critical organizations. They are classified based on their urgency:

URGENT — Actions Immediately

1. Audit Sieve Forwarding Rules

IMMEDIATELY check for auto -forwarding rules in webmail systems (Roundcube, SquirrelMail). Look specifically for rules with names like "SystemProtect" or "SystemHealthChek". Delete any rule that was not intentionally created by administrators.

2. TOTP Secrets Renewal

If your users have been using Roundcube with the twofactorauthenticator plugin for the last 18 months, consider all TOTP secrets potentially compromised. Proceed with a full 2FA re-enrollment for ALL privileged users.

3. Block IOCs

1. Add 203.161.50[.]145 to firewall, IDS/IPS, proxy
2. Block the domain zhblz.com in DNS filtering
3. Check logs for past communication with these addresses (at least 18 months back)

SHORT TERM — Within 30 Days

4. Update Roundcube and SquirrelMail

Apply the patch for CVE-2023-43770 immediately . Update to Roundcube 1.6.6+ / 1.5.6+ / 1.4.15+. Evaluate whether SquirrelMail is still justified or should be replaced.

5. ManageSieve / Risky Plugins Review

Evaluate whether the ManageSieve and the twofactorauthenticator plugin are necessary. If they are not actively used, disable them. If they are necessary, implement network-level controls that limit which users can create forwarding rules.

6. Threat Hunting in Logs

Look in your logs for activity that suggests XSS exploitation: unusual GET requests from webmail sessions, requests to the 2FA settings page outside of business hours, bulk requests to .eml download endpoints.

LONG TERM — Architectural Improvement

7. Migrating from Legacy Webmail

Roundcube and SquirrelMail are on-premises webmail solutions that require regular maintenance and have a history of XSS vulnerabilities. Consider migrating to more modern, cloud-hosted email solutions with built-in security controls.

8. Hardware Security Keys for High-Value Accounts

TOTP -based 2FA systems (Google Authenticator, Authy) are vulnerable to the type of attack used by APT28. For privileged accounts in government and military systems, consider implementing hardware security keys (FIDO2/WebAuthn), which are resistant to this vector.

9. Reporting to the Competent Authorities

If you suspect a breach or have identified IOCs corresponding to this campaign:

• National Cybersecurity Authority (NCSA): incident[@]cyber.gov.gr
• CERT-GR (GR-CERT): For technical reporting and coordination
• Ctrl-Alt-Intel (for additional IOCs): contact@ctrlaltintel.com
• If it concerns military networks: Cyber ​​Defense Service of the General Staff/General Staff/General Staff

See also: APT28 hackers exploit zero-day Microsoft Office vulnerability

10. Broader Implications for Europe and NATO

The Fancy Bear / APT28 2026 case has significant implications beyond the directly targeted countries:

10.1 The Threat to Webmail Worldwide

The number of government and military organizations that still use on-premises webmail (Roundcube, SquirrelMail, Zimbra) is surprisingly large. These systems are technically complex to manage and often do not receive regular security updates. APT28 knows this and selectively targets organizations that use them.

10.2 The Lie of the “Sophisticated APT”

The case reveals a fundamental contradiction in the way we perceive state-sponsored APT groups: we label them as “highly sophisticated,” but in practice they make primitive OPSEC mistakes. APT28 left their C2 server open for 500+ days after the disclosure — using a Python command that a junior developer could use.

The real "sophistication" lies not in the techniques (their XSS payloads are mediocre if not simple), but in strategic patience and the ability to remain undetected for long periods in environments that lack adequate threat hunting.

10.3 The Failure of Domestic Detection Mechanisms

One of the most worrying conclusions: APT28 was detected by foreign private researchers (Hunt.io, Ctrl-Alt-Intel) — not by the cybersecurity authorities victims’. This is not just a Greek problem — it is a European one. Investing in threat intelligence and threat hunting domestic.

Conclusion

The APT28 campaign, revealed in March 2026, is not an academic cybersecurity issue. It is a confirmed, active Russian espionage operation that hit the Greek National Defense General Staff, bypassed even two-factor authentication, and maintained permanent access via forwarding rules that survive even after a password change.

Technical analysis shows that APT28 did not require highly advanced techniques — all it needed was an unpatched Roundcube server and unsuspecting users. Countering the threat does not require exotic tools — it requires basic cybersecurity hygiene: patch management, threat hunting, and proper 2FA management.

For Greece specifically, the question is not if APT28 will strike again — it's when and if we will be ready to see it this time with our own eyes!

Information from: ctrlaltintel.com