The risk actor often known as Winter Vivern has been noticed exploiting a zero-day flaw in Roundcube webmail software program on October 11, 2023, to reap e mail messages from victims’ accounts.
“Winter Vivern has stepped up its operations through the use of a zero-day vulnerability in Roundcube,” ESET safety researcher Matthieu Faou mentioned in a brand new report revealed at present. Beforehand, it was utilizing identified vulnerabilities in Roundcube and Zimbra, for which proofs-of-concept can be found on-line.”
Winter Vivern, also called TA473 and UAC-0114, is an adversarial collective whose aims align with that of Belarus and Russia. Over the previous few months, it has been attributed to assaults in opposition to Ukraine and Poland, in addition to authorities entities throughout Europe and India.
The group can also be assessed to have exploited one other flaw Roundcube beforehand (CVE-2020-35730), making it the second nation-state group after APT28 to focus on the open-source webmail software program.
The brand new safety vulnerability in query is CVE-2023-5631 (CVSS rating: 5.4), a saved cross-site scripting flaw that might enable a distant attacker to load arbitrary JavaScript code. A repair was launched on October 14, 2023.
Assault chains mounted by the group start with a phishing message that includes a Base64-encoded payload within the HTML supply code that, in flip, decodes to a JavaScript injection from a distant server by weaponizing the XSS flaw.
“In abstract, by sending a specifically crafted e mail message, attackers are capable of load arbitrary JavaScript code within the context of the Roundcube consumer’s browser window,” Faou defined. “No handbook interplay apart from viewing the message in an online browser is required.”
The second-stage JavaScript (checkupdate.js) is a loader that facilitates the execution of a ultimate JavaScript payload that permits the risk actor to exfiltrate e mail messages to a command-and-control (C2) server.
“Regardless of the low sophistication of the group’s toolset, it’s a risk to governments in Europe due to its persistence, very common working of phishing campaigns, and since a big variety of internet-facing functions will not be commonly up to date though they’re identified to comprise vulnerabilities,” Faou mentioned.
