Rounding Up DNS Facts about Operation RoundPress

Additions made to the Cybersecurity & Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog¹ on 9 June 2025 CVE-2025-32433² and CVE-2024-42009³ were reportedly abused by APT28 to hack government webmail servers⁴ in an operation dubbed “RoundPress.”

WhoisXML API expanded the list of 19 indicators of compromise (IoCs)⁵ ESET researchers identified related to Operation RoundPress to uncover more potentially connected artifacts. Our analysis led to the discovery of:

• 8,222 email-connected domains, seven of which were malicious
• Two IP addresses, both were malicious
• 102 IP-connected domains
• 580 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• [2] https://www.cve.org/CVERecord?id=CVE-2025-32433
• [3] https://www.cve.org/CVERecord?id=CVE-2024-42009
• [4] https://thehackernews.com/2025/05/russia-linked-apt28-exploited-mdaemon.html
• [5] https://www.welivesecurity.com/en/eset-research/operation-roundpress/