Threat actormedium
Russia-linked hackers target webmail servers in Ukraine-related espionage operation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-43770 | Persistent Cross-Site Scripting in Roundcube Webmail (Exploited in the Wild) | 6.1 | 64% | KEV | KEV |
| CVE-2024-11182 | Unauthenticated Cross-Site Scripting (XSS) in MDaemon Email Server Webmail | 5.3 | 33% | KEV | KEV |
From the original article
2 min read at helpnetsecurity.com
ESET researchers have uncovered RoundPress, a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities. Behind it is most likely the Russia-aligned Sednit (also known as Fancy Bear or APT28) cyberespionage group, holding the ultimate goal of stealing confidential data from specific email accounts. Most of the targets are related to the current war in Ukraine.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.