Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates. Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook. | 9.8 | 97% | KEV |
| masson the order of hundreds of millions of users (Outlook ships with Microsoft Office/Microsoft 365, the dominant enterprise and government email suite) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | bugiplaysec.com | ictim IP address was observed communicating with the domain bugiplaysec[.]com over TCP port 443, which at the time resolved to IP addre |
| domain | hitsbitsx.com | ce: Recorded Future) On July 27, 2023, a new TAG-70 domain, hitsbitsx[.]com, resolved to IP address 176.97.66[.]57. Insikt Group also |
| domain | mail.mod.gov.ge | tors were targeting the Georgian Ministry of Defence domain mail[.]mod[.]gov[.]ge. The structure of this payload overlaps with the one |
| domain | ocsp-reloads.com | Uzbekistan in Ukraine and a previously reported C2 domain, ocsp-reloads[.]com, which resolved to IP address 38.180.2[.]23. This additio |
| sha256 | 6800357ec3092c56aab17720897c29bb389f70cb49223b289ea5365314199a26 | ied a related JavaScript sample from November 2022 (SHA256: 6800357ec3092c56aab17720897c29bb389f70cb49223b289ea5365314199a26). This older sample was hosted on the domain bugiplaysec[.] |
| sha256 | ea22b3e9ecdfd06fae74483deb9ef0245aefdc72f99120ae6525c0eaf37de32e | ed malware sample uploaded to a malware repository (SHA256: ea22b3e9ecdfd06fae74483deb9ef0245aefdc72f99120ae6525c0eaf37de32e). The discovered JavaScript malware matches the second-stag |
Full article811 words · extracted from recordedfuture.com · click to collapse
Recorded Future’s Insikt Group has identified TAG-70, a threat actor likely operating on behalf of Belarus and Russia, conducting cyber-espionage against government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020. TAG-70 overlaps with activity reported by other security vendors under the aliases Winter Vivern, TA473, and UAC-0114.
In its latest campaign, which ran between October and December 2023, TAG-70 exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers in its targeting of over 80 organizations, primarily in Georgia, Poland, and Ukraine. This campaign has been linked to additional TAG-70 activity against Uzbekistan government mail servers, which involved infrastructure reported by Insikt Group in February 2023.
TAG-70’s targeting of Roundcube webmail servers is only the most recent instance of targeting email software attributed to Russia-aligned threat actor groups. In June 2023, Insikt Group discovered that the Russian state-sponsored cyber-espionage group BlueDelta (APT28, Fancy Bear) was targeting vulnerable Roundcube installations across Ukraine and had previously exploited CVE-2023-23397, a critical zero-day vulnerability in Microsoft Outlook in 2022. Other well-known Russian threat actor groups, such as Sandworm and BlueBravo (APT29, Midnight Blizzard), have also previously targeted email solutions in various campaigns.
Geographic spread of victims of TAG-70s Roundcube exploit in October 2023 (Source: Recorded Future)
In this campaign, beginning on March 16, 2023, Insikt Group used Recorded Future Network Intelligence to detect suspicious activity from a victim IP address belonging to the Center for Economic Research and Reforms of Uzbekistan. The victim IP address was observed communicating with the domain bugiplaysec[.]com over TCP port 443, which at the time resolved to IP address 176.97.66[.]57. This data was then likely relayed to command and control (C2) IP address 198.50.170[.]72 on TCP port 7662. It is suspected that TAG-70 administered 198.50.170[.]72 via Tor. CERT-UA attributed the domain bugiplaysec[.]com to TAG-70 in February 2023.
Insikt Group observed similar activity between an IP address registered to the Embassy of the Republic of Uzbekistan in Ukraine and a previously reported C2 domain, ocsp-reloads[.]com, which resolved to IP address 38.180.2[.]23. This additional C2 likely forwarded the data it received to IP address 86.105.18[.]113 on TCP port 1194 and TAG-70 likely connected to the C2 via Tor, also below.
TAG-70 operational infrastructure in March 2023 (Source: Recorded Future)
On July 27, 2023, a new TAG-70 domain, hitsbitsx[.]com, resolved to IP address 176.97.66[.]57. Insikt Group also detected this domain in a JavaScript-based malware sample uploaded to a malware repository (SHA256: ea22b3e9ecdfd06fae74483deb9ef0245aefdc72f99120ae6525c0eaf37de32e). The discovered JavaScript malware matches the second-stage loader used in TAG-70’s previous Roundcube exploitation described by ESET. This JavaScript is loaded via XSS from a malicious email and is used to decode a Base64-encoded JavaScript payload (jsBodyBase64). The payload is then inserted into the Document Object Model (DOM) of the Roundcube webpage within a newly created script tag.
The content of the JavaScript payload, jsBodyBase64, shown in Figure 3, suggests the actors were targeting the Georgian Ministry of Defence domain mail[.]mod[.]gov[.]ge. The structure of this payload overlaps with the one described in ESET’s report; however, its functionality differs: instead of exfiltrating the contents of the victim’s mailbox, it logs the user out of Roundcube and presents them with a new sign-in window. When the victim submits their credentials, their account name, username, and password are sent to the C2 server, and they are then logged into Roundcube.
Insikt Group also identified a related JavaScript sample from November 2022 (SHA256: 6800357ec3092c56aab17720897c29bb389f70cb49223b289ea5365314199a26). This older sample was hosted on the domain bugiplaysec[.]com, used the same JavaScript loader technique, and had a similar credential exfiltration payload. The content within the payload suggests that it was used to target the Ukrainian Ministry of Defence.
The compromised email servers represent a significant risk, particularly in the context of the ongoing conflict in Ukraine. They could expose sensitive information about Ukraine's war effort, its diplomatic relations, and its coalition partners. Moreover, the targeting of Iranian embassies in Russia and the Netherlands suggests a broader geopolitical interest in assessing Iran's diplomatic activities, especially regarding its support for Russia in Ukraine. Similarly, espionage against Georgian government entities reflects interests in monitoring Georgia's aspirations for European Union (EU) and NATO accession.
Mitigation Strategies
To mitigate the risk posed by TAG-70's campaign, organizations should ensure that their Roundcube installations are patched and up-to-date, while actively hunting for indicators of compromise (IoCs) in their environments. The sophistication of TAG-70's attack methods and its targeting of government and military entities underscore the need for robust cybersecurity measures and proactive threat intelligence efforts. The widespread nature of TAG-70's activities and its potential impact on national security highlight the urgency for vigilance and preparedness among affected organizations and government agencies.
Note: This report summary was first published on February 16, 2024 and has been updated on October 29, 2024. The original analysis and findings remain unchanged.
To read the entire analysis, click here to download the report as a PDF.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.recordedfuture.com/research/russia-aligned-tag-70-targets-european-government-and-military-mail