Article Details
Scrape Timestamp (UTC): 2023-10-25 13:23:12.545
Source: https://thehackernews.com/2023/10/nation-state-hackers-exploiting-zero.html
Original Article Text
Click to Toggle View
Nation State Hackers Exploiting Zero-Day in Roundcube Webmail Software. The threat actor known as Winter Vivern has been observed exploiting a zero-day flaw in Roundcube webmail software on October 11, 2023, to harvest email messages from victims' accounts. "Winter Vivern has stepped up its operations by using a zero-day vulnerability in Roundcube," ESET security researcher Matthieu Faou said in a new report published today. Previously, it was using known vulnerabilities in Roundcube and Zimbra, for which proofs-of-concept are available online." Winter Vivern, also known as TA473 and UAC-0114, is an adversarial collective whose objectives align with that of Belarus and Russia. Over the past few months, it has been attributed to attacks against Ukraine and Poland, as well as government entities across Europe and India. The group is also assessed to have exploited another flaw Roundcube previously (CVE-2020-35730), making it the second nation-state group after APT28 to target the open-source webmail software. The new security vulnerability in question is CVE-2023-5631 (CVSS score: 5.4), a stored cross-site scripting flaw that could allow a remote attacker to load arbitrary JavaScript code. A fix was released on October 14, 2023. Attack chains mounted by the group commence with a phishing message that incorporates a Base64-encoded payload in the HTML source code that, in turn, decodes to a JavaScript injection from a remote server by weaponizing the XSS flaw. "In summary, by sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user's browser window," Faou explained. "No manual interaction other than viewing the message in a web browser is required." The second-stage JavaScript (checkupdate.js) is a loader that facilitates the execution of a final JavaScript payload that allows the threat actor to exfiltrate email messages to a command-and-control (C2) server. "Despite the low sophistication of the group's toolset, it is a threat to governments in Europe because of its persistence, very regular running of phishing campaigns, and because a significant number of internet-facing applications are not regularly updated although they are known to contain vulnerabilities," Faou said.
Daily Brief Summary
The threat actor group known as Winter Vivern, linked with Belarus and Russia, has been exploiting a zero-day flaw in the Roundcube webmail software to harvest email messages from victims' accounts.
This new security vulnerability (CVE-2023-5631) is a stored cross-site scripting flaw that can be used to load any JavaScript code; a fix was released on October 14, 2023.
Winter Vivern, also known as TA473 and UAC-0114, has been involved in attacks against Ukraine and Poland, alongside governmental entities across Europe and India.
The group uses a phishing message carrying a Base64-encoded payload concealed in the HTML source code, which then translates to a JavaScript injection from a remote server.
The final JavaScript payload allows the threat actor to exfiltrate email messages to a command-and-control server.
ESET security researcher, Matthieu Faou, notes that the low sophistication of Winter Vivern's toolset should not undermine its threat, given their persistence, regularity of phishing campaigns and the high number of un-updated internet-facing applications.