Russia-linked APT28 group spotted exploiting Outlook flaw to hijack MS Exchange accounts

Roundcube Webmail versions before 1.4.4 contain an OS command injection flaw (CWE-78) in rcube_image.php: shell metacharacters in the im_convert_path or im_identify_path configuration settings are not escaped before the configured ImageMagick binaries are executed. When image processing is triggered, an attacker who can control those configuration values can append arbitrary shell commands that run with the privileges of the web server user, yielding full remote code execution on the mail server. Successful exploitation can expose stored email, mail credentials, and the underlying host; the flaw is scored 9.8 (critical), with no privileges or user interaction required per the CVSS vector. Any self-hosted Roundcube deployment older than 1.4.4 is affected, including Roundcube packages shipped by openSUSE Leap and openSUSE Backports for SUSE Linux Enterprise. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2023-06-22, EPSS puts the 30-day exploitation probability at ~84%, and headlines note APT28-linked activity targeting government Roundcube servers, including Ukrainian entities.

Do: Upgrade Roundcube to 1.4.4 or later, or apply the vendor-patched openSUSE Leap / SLE backport packages, as required by the CISA KEV listing (added 2023-06-22). After patching, verify that im_convert_path and im_identify_path settings contain no unescaped metacharacters and review web server logs for injected command activity; given APT28's targeting of government Roundcube servers, prioritize public-sector mail infrastructure for patching and threat hunting.

Roundcube Webmail contains a cross-site scripting (XSS) flaw (CWE-79) in the link-reference handling of rcube_string_replacer.php, where the linkref_addindex function mishandles JavaScript embedded in a link element of a plain-text email. An attacker triggers the flaw simply by sending a crafted plain-text message to a victim; when the message is processed/displayed in the Roundcube interface, the embedded script executes in the context of the victim's webmail session. Successful exploitation can lead to session hijacking, theft of webmail cookies or credentials, and arbitrary actions in the victim's mailbox. Any deployment of Roundcube Webmail is affected, which includes self-hosted instances and webmail offered by hosting providers, ISPs, and universities. Although no public proof-of-concept is known, CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2023-06-22, confirming exploitation in the wild; ransomware association is unknown, and no CVSS score is yet available, though EPSS puts 30-day exploitation probability at 32.7% (98th percentile).

Do: Apply the vendor's updated Roundcube release per CISA's required action (updates per vendor instructions); since no specific fixed versions appear in this data, install the latest patched release of your deployed 1.x branch and verify with the vendor advisory. Check webmail servers for processing of plain-text messages with link-reference elements and review logs for anomalous webmail sessions; treat KEV-listed status as evidence of active exploitation and prioritize internet-exposed Roundcube instances.

CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021.

Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file.

Roundcube Webmail contains a SQL injection flaw (CWE-89) in which attacker-controlled 'search' or 'search_params' input is incorporated into database queries without sufficient sanitization. An attacker with access to the webmail search functionality (typically an authenticated mailbox user) can submit crafted parameters to execute arbitrary SQL against the Roundcube backend database, potentially reading or modifying stored mail account data. Any organization running Roundcube is affected, including self-hosted mail servers and customers of hosting providers that ship Roundcube as their bundled webmail client. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-22, indicating exploitation in the wild, and EPSS assigns a 41.9% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, and CISA lists ransomware use as unknown.

Do: Apply vendor updates per Roundcube's instructions by upgrading to the latest patched, supported release, prioritizing internet-facing webmail servers; federal agencies must remediate per the CISA KEV requirement. If Roundcube is managed by a hosting provider (e.g., via cPanel), coordinate patching with them. In the interim, restrict webmail exposure and review database and web logs for anomalous search-related queries that may indicate exploitation.

CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28.

Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly.

CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates.

Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook.

RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24.

Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable.