A relentless workforce of pro-Russia hackers has been exploiting a zero-day vulnerability in broadly used webmail software program in assaults focusing on governmental entities and a suppose tank, all in Europe, researchers from safety agency ESET mentioned on Wednesday.
No handbook interplay required
The assaults started on October 11, and ESET detected them a day later. ESET reported the zero-day vulnerability to Roundcube builders on the identical day, they usually issued a patch on October 14. The vulnerability is tracked as CVE-2023-5631 and impacts Roundcube variations 1.6.x earlier than 1.6.4, 1.5.x earlier than 1.5.5, and 1.4.x earlier than 1.4.15.
Winter Vivern has been working since no less than 2020 and targets governments and suppose tanks, primarily in Europe and Central Asia. In March, the menace group was noticed targeting US government officials who had voiced help for Ukraine in its bid to drive again Russia’s invasion. These assaults additionally exfiltrated targets’ emails however exploited a separate, already-patched XSS in Zimbra Collaboration, a software program package deal that’s additionally used to host webmail portals.
“This actor has been tenacious in its focusing on of American and European officers in addition to army and diplomatic personnel in Europe,” a menace researcher from safety agency Proofpoint mentioned in March when disclosing the assaults exploiting the Zimbra vulnerability. “Since late 2022, [Winter Vivern] has invested an ample period of time learning the webmail portals of European authorities entities and scanning publicly dealing with infrastructure for vulnerabilities all in an effort to in the end achieve entry to emails of these carefully concerned in authorities affairs and the Russia-Ukraine battle.”
The e-mail Winter Vivern used within the latest marketing campaign got here from the handle firstname.lastname@example.org and had the topic “Get began in your Outlook.”
Winter Vivern’s earlier success exploiting an already-patched Zimbra vulnerability needs to be a warning. Anybody utilizing Roundcube as both a server admin or an finish consumer ought to make sure the software program is operating a patched model.