[ad_1]
The risk actor often called Winter Vivern has been noticed exploiting a zero-day flaw in Roundcube webmail software program on October 11, 2023, to reap electronic mail messages from victims’ accounts.
“Winter Vivern has stepped up its operations by utilizing a zero-day vulnerability in Roundcube,” ESET safety researcher Matthieu Faou mentioned in a brand new report printed immediately. Beforehand, it was utilizing recognized vulnerabilities in Roundcube and Zimbra, for which proofs-of-concept can be found on-line.”
Winter Vivern, often known as TA473 and UAC-0114, is an adversarial collective whose aims align with that of Belarus and Russia. Over the previous few months, it has been attributed to assaults in opposition to Ukraine and Poland, in addition to authorities entities throughout Europe and India.
The group can be assessed to have exploited one other flaw Roundcube beforehand (CVE-2020-35730), making it the second nation-state group after APT28 to focus on the open-source webmail software program.
The brand new safety vulnerability in query is CVE-2023-5631 (CVSS rating: 5.4), a saved cross-site scripting flaw that would enable a distant attacker to load arbitrary JavaScript code. A repair was launched on October 14, 2023.
Assault chains mounted by the group begin with a phishing message that includes a Base64-encoded payload within the HTML supply code that, in flip, decodes to a JavaScript injection from a distant server by weaponizing the XSS flaw.
“In abstract, by sending a specifically crafted electronic mail message, attackers are capable of load arbitrary JavaScript code within the context of the Roundcube consumer’s browser window,” Faou defined. “No guide interplay aside from viewing the message in an online browser is required.”
The second-stage JavaScript (checkupdate.js) is a loader that facilitates the execution of a closing JavaScript payload that enables the risk actor to exfiltrate electronic mail messages to a command-and-control (C2) server.
“Regardless of the low sophistication of the group’s toolset, it’s a risk to governments in Europe due to its persistence, very common operating of phishing campaigns, and since a major variety of internet-facing functions usually are not repeatedly up to date though they’re recognized to include vulnerabilities,” Faou mentioned.
[ad_2]