Russian Hackers Caught Exploiting Roundcube Webmail Zero-Day

Russian Hackers Caught Exploiting Roundcube Webmail Zero-Day

October 25, 2023 at 12:16PM

Winter Vivern, a Russia-linked advanced persistent threat (APT) actor, has been exploiting a zero-day vulnerability in the Roundcube webmail server to target government entities and a think tank in Europe. Winter Vivern, also known as TA473, focuses on espionage and has previously targeted NATO countries. It has been targeting email servers using known vulnerabilities and recently exploited a zero-day cross-site scripting (XSS) vulnerability in Roundcube. The attacker sends specially crafted email messages to inject JavaScript code and exfiltrate emails. The vulnerability has been patched, and organizations are advised to update their instances to protect against Winter Vivern’s attacks.

Key Takeaways from Meeting Notes:

1. The Russia-linked advanced persistent threat (APT) actor Winter Vivern has been exploiting a zero-day vulnerability in the Roundcube webmail server to target government entities and a think tank in Europe.
2. Winter Vivern, also known as TA473, primarily focuses on espionage and conducts cyberattacks in support of Russian and Belarusian objectives, particularly relating to the Russia-Ukraine war.
3. Winter Vivern has been targeting Zimbra and Roundcube email servers of government organizations in Europe and Central Asia since at least 2022, utilizing known vulnerabilities for which proof-of-concept exploits are available online.
4. In recent attacks, Winter Vivern exploited the CVE-2023-5631 zero-day cross-site scripting (XSS) vulnerability in Roundcube’s webmail server. This allowed the threat actor to inject malicious JavaScript code by sending specially crafted email messages with a malicious SVG document.
5. The final payload of Winter Vivern’s attack aimed to list folders and exfiltrate emails from the targeted Roundcube accounts to the attacker’s command-and-control (C&C) server.
6. ESET reported the exploitation of CVE-2023-5631 on October 11, and a patch was released by Roundcube on October 16. Roundcube versions 1.4.15, 1.5.5, and 1.6.4 contain patches for this vulnerability.
7. Organizations are strongly advised to update their Roundcube instances promptly to mitigate the risk posed by Winter Vivern attacks.
8. ESET researcher Matthieu Faou highlights Winter Vivern’s persistence, consistent phishing campaigns, and the prevalence of unpatched vulnerabilities in internet-facing applications as major concerns for European governments.

These takeaways summarize the meeting notes regarding Winter Vivern’s exploitation of the Roundcube zero-day vulnerability and provide recommendations for organizations to address the issue.

Full Article