The Winter Vivern Russian hacking group has been exploiting a Roundcube Webmail zero-day successful attacks targeting European authorities entities and deliberation tanks since astatine slightest October 11.
The Roundcube improvement squad released security updates fixing nan Stored Cross-Site Scripting (XSS) vulnerability (CVE-2023-5631) reported by ESET researchers connected October 16.
These information patches were pushed 5 days aft nan Slovak cybersecurity institution detected Russian threat actors utilizing nan zero-day successful real-world attacks.
Their phishing messages impersonated nan Outlook Team and tried to instrumentality imaginable victims into opening malicious emails, automatically triggering a first-stage payload that exploited nan Roundcube email server vulnerability.
First spotted in April 2021, Winter Vivern has garnered attraction for its deliberate targeting of authorities entities crossed nan globe, including nations specified arsenic India, Italy, Lithuania, Ukraine, and nan Vatican.
According to SentinelLabs researchers, nan group's objectives intimately align pinch nan interests of nan governments of Belarus and Russia.
Winter Vivern has been actively targeting Zimbra and Roundcube email servers owned by governmental organizations since astatine slightest 2022.
These attacks included exploiting nan Roundcube XSS vulnerability (CVE-2020-35730) betwixt August and September 2023, per ESET telemetry data.
Notably, this aforesaid vulnerability was exploited by Russian APT28 subject intelligence hackers affiliated pinch Russia's General Staff Main Intelligence Directorate (GRU) to discuss Roundcube email servers belonging to nan Ukrainian government.
The Russian cyberspies besides exploited nan Zimbra CVE-2022-27926 XSS vulnerability successful attacks against NATO countries to bargain emails belonging to NATO officials, governments, and subject personnel.
"Winter Vivern has stepped up its operations by utilizing a zero-day vulnerability successful Roundcube. Previously, it was utilizing known vulnerabilities successful Roundcube and Zimbra, for which proofs of conception are disposable online," ESET said.
"The group is simply a threat to governments successful Europe because of its persistence, very regular moving of phishing campaigns, and because a important number of internet-facing applications are not regularly updated though they are known to incorporate vulnerabilities."