Russia-aligned hackers target European and Iranian embassies in new espionage campaign
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-43770 | Persistent Cross-Site Scripting in Roundcube Webmail (Exploited in the Wild) Roundcube Webmail versions before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 contain a persistent cross-site scripting (XSS) flaw (CWE-79) caused by how program/lib/Roundcube/rcube_string_replacer.php converts plain text into clickable links. An attacker sends a text/plain email containing crafted links; when the recipient views the message, the crafted link text is turned into HTML that runs attacker-controlled script, which persists and executes in the victim's webmail session. Successful exploitation lets the attacker execute JavaScript with the victim's session, enabling mailbox access, theft of session credentials, and actions performed as the user (CVSS 6.1, scope-changed with limited confidentiality and integrity impact). Anyone running an affected Roundcube instance is exposed, including the roundcube package shipped with Debian Linux. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-02-12, and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile). Do: Upgrade Roundcube to 1.4.14, 1.5.4, or 1.6.3 (or later, per branch), or install the updated roundcube package on Debian. Because the bug is in CISA's KEV catalog, U.S. federal agencies must apply the vendor fix by the catalog due date, and other defenders should prioritize patching internet-facing webmail servers. Review webmail access logs for suspicious message views or account activity, and consider forcing session re-authentication for accounts that opened crafted plain-text messages. | 6.1 | 58% | KEV |
| massplausibly millions of users across tens of thousands of internet-exposed Roundcube instances (estimate) |
Full article549 words · extracted from therecord.media · click to collapse
A Russia-linked hacking group is exploiting a known bug in a popular webmail server to spy on government and military agencies in Europe, as well as Iranian embassies in Russia, according to a new report. In a recent espionage campaign, the hackers tracked as TAG-70 used a cross-site scripting (XSS) vulnerability in the Roundcube web-based email server. During XSS attacks, malicious scripts are injected by hackers into otherwise benign and trusted websites. The goal of the group’s latest campaign was to collect intelligence on European political and military activities, "possibly to gain strategic advantages or undermine European security and alliances," according to researchers from Recorded Future’s Insikt Group, who analyzed the attacks and presented on the topic at the Munich Security Conference. The Record is an editorially independent unit of Recorded Future. Earlier in February, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Roundcube bug, tracked as CVE-2023-43770, to its catalog of known exploited vulnerabilities. “These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said. According to the Insikt Group’s report, the hackers, who overlap with the Winter Vivern group, likely started exploiting Roundcube webmail servers at the beginning of October 2023 and continued until at least mid-October. Winter Vivern has been active since at least December 2020 and likely conducts cyber-espionage campaigns to serve the interests of Belarus and Russia. The group employs advanced techniques and tools, indicating that it’s a "well-funded and skilled threat actor that demonstrated a high level of sophistication in its attack methods,” researchers said. Its victims were mostly located in Georgia, Poland, and Ukraine. The targeting of the Iranian embassies in Russia and the Netherlands may be linked to a desire “to assess Iran's current diplomatic activities and foreign policy, especially as Russia continues to rely on Iran-provided weapons in Ukraine,” according to the report. Winter Vivern’s attack on Roundcube webmail servers is the most recent instance of targeting email software attributed to Russia-aligned threat actors, researchers said. Last June, Insikt researchers discovered that the Russian state-sponsored cyber-espionage group BlueDelta, which overlaps with Fancy Bear, was targeting vulnerable Roundcube installations across Ukraine and had previously exploited a critical zero-day vulnerability in Microsoft Outlook. Other Russian state hackers, such as Sandworm and Midnight Blizzard, have also targeted email services in various campaigns. Winter Vivern poses a significant threat to Ukraine, as compromised email servers may expose sensitive information regarding Ukraine’s war effort and planning, its relationships, and negotiations with its partner countries, researchers said. Last February, the group infected Ukrainian government computers with malware hosted on fake websites impersonating legitimate state services. During the campaign in March, Winter Vivern targeted government agencies and telecom operators in Ukraine, India, and Europe. Ukraine’s cybersecurity agency did not respond to a request for comment about Roundcube hack targets in Ukraine. READ MORE: Munich Cyber Security Conference 2024 Live Updates
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/russia-aligned-hackers-target-european-and-iranian-embassies-cyber-espionage