The risk actor often called Winter Vivern has been noticed exploiting a zero-day flaw in Roundcube webmail software program on October 11, 2023, to reap e mail messages from victims’ accounts.
“Winter Vivern has stepped up its operations by utilizing a zero-day vulnerability in Roundcube,” ESET safety researcher Matthieu Faou mentioned in a brand new report revealed in the present day. Beforehand, it was utilizing identified vulnerabilities in Roundcube and Zimbra, for which proofs-of-concept can be found on-line.”
Winter Vivern, also called TA473 and UAC-0114, is an adversarial collective whose targets align with that of Belarus and Russia. Over the previous few months, it has been attributed to assaults in opposition to Ukraine and Poland, in addition to authorities entities throughout Europe and India.
The group can also be assessed to have exploited one other flaw Roundcube beforehand (CVE-2020-35730), making it the second nation-state group after APT28 to focus on the open-source webmail software program.
The brand new safety vulnerability in query is CVE-2023-5631 (CVSS rating: 5.4), a saved cross-site scripting flaw that might permit a distant attacker to load arbitrary JavaScript code. A repair was launched on October 14, 2023.
Assault chains mounted by the group begin with a phishing message that comes with a Base64-encoded payload within the HTML supply code that, in flip, decodes to a JavaScript injection from a distant server by weaponizing the XSS flaw.
“In abstract, by sending a specifically crafted e mail message, attackers are in a position to load arbitrary JavaScript code within the context of the Roundcube consumer’s browser window,” Faou defined. “No handbook interplay apart from viewing the message in an online browser is required.”
The second-stage JavaScript (checkupdate.js) is a loader that facilitates the execution of a remaining JavaScript payload that permits the risk actor to exfiltrate e mail messages to a command-and-control (C2) server.
“Regardless of the low sophistication of the group’s toolset, it’s a risk to governments in Europe due to its persistence, very common working of phishing campaigns, and since a major variety of internet-facing functions usually are not commonly up to date though they’re identified to include vulnerabilities,” Faou mentioned.