A Russia-linked risk actor has been attributed to a cyber espionage operation focusing on webmail servers akin to Roundcube, Horde, MDaemon, and Zimbra by way of cross-site scripting (XSS) vulnerabilities, together with a then-zero-day in MDaemon, in response to new findings from ESET.
The exercise, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity firm. It has been attributed with medium confidence to the Russian state-sponsored hacking group tracked as APT28, which can also be known as BlueDelta, Fancy Bear, Combating Ursa, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422.
“The final word aim of this operation is to steal confidential information from particular e mail accounts,” ESET researcher Matthieu Faou stated in a report shared with The Hacker Information. “Most victims are governmental entities and protection corporations in Japanese Europe, though we have now noticed governments in Africa, Europe, and South America being focused as properly.”
This isn’t the primary time APT28 has been tied to assaults exploiting flaws in webmail software program. In June 2023, Recorded Future detailed the risk actor’s abuse of a number of flaws in Roundcube (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to conduct reconnaissance and information gathering.
Since then, different risk actors like Winter Vivern and UNC3707 (aka GreenCube) have additionally focused e mail options, together with Roundcube, in numerous campaigns over time. Operation RoundPress’ ties to APT28 stem from overlaps within the e mail handle used to ship the spear-phishing emails and similarities in the way in which sure servers had been configured.
A majority of the targets of the marketing campaign in 2024 have been discovered to be Ukrainian governmental entities or protection corporations in Bulgaria and Romania, a few of that are producing Soviet-era weapons to be despatched to Ukraine. Different targets embrace authorities, army, and tutorial organizations in Greece, Cameroon, Ecuador, Serbia, and Cyprus.
The assaults entail the exploitation of XSS vulnerabilities in Horde, MDaemon, and Zimbra to execute arbitrary JavaScript code within the context of the webmail window. It is price noting that CVE-2023-43770, an XSS bug in Roundcube, was added by the U.S. Cybersecurity and Infrastructure Safety Company (CISA) to its Recognized Exploited Vulnerabilities (KEV) catalog in February 2024.
Whereas the assaults focusing on Horde (an unspecified outdated flaw fastened in Horde Webmail 1.0 launched in 2007), Roundcube (CVE-2023-43770), and Zimbra (CVE-2024-27443) leveraged safety defects already recognized and patched, the MDaemon XSS vulnerability is assessed to have been utilized by the risk actor as a zero-day. Assigned the CVE identifier CVE-2024-11182 (CVSS rating: 5.3), it was patched in model 24.5.1 final November.
“Sednit sends these XSS exploits by e mail,” Faou stated. “The exploits result in the execution of malicious JavaScript code within the context of the webmail shopper internet web page working in a browser window. Due to this fact, solely information accessible from the sufferer’s account will be learn and exfiltrated.”
Nonetheless, for the exploit to achieve success, the goal have to be satisfied to open the e-mail message within the weak webmail portal, assuming it is in a position to bypass the software program’s spam filters and land on the consumer’s inbox. The contents of the e-mail themselves are innocuous, because the malicious code that triggers the XSS flaw resides throughout the HTML code of the e-mail message’s physique and, due to this fact, shouldn’t be seen to the consumer.
Profitable exploitation results in the execution of an obfuscated JavaScript payload named SpyPress that comes with the power to steal webmail credentials and harvest e mail messages and get in touch with data from the sufferer’s mailbox. The malware, regardless of missing a persistence mechanism, will get reloaded each time the booby-trapped e mail message is opened.
“As well as, we detected a number of SpyPress.ROUNDCUBE payloads which have the power to create Sieve guidelines,” ESET stated. “SpyPress.ROUNDCUBE creates a rule that can ship a duplicate of each incoming e mail to an attacker-controlled e mail handle. Sieve guidelines are a characteristic of Roundcube and due to this fact the rule might be executed even when the malicious script is now not working.”
The gathered data is subsequently exfiltrated by way of an HTTP POST request to a hard-coded command-and-control (C2) server. Choose variants of the malware have additionally been discovered to seize login historical past, two-factor authentication (2FA) codes, and even create an software password for MDAEMON to retain entry to the mailbox even when the password or the 2FA code will get modified.
“Over the previous two years, webmail servers akin to Roundcube and Zimbra have been a significant goal for a number of espionage teams akin to Sednit, GreenCube, and Winter Vivern,” Faou stated. “As a result of many organizations do not preserve their webmail servers updated and since the vulnerabilities will be triggered remotely by sending an e mail message, it is extremely handy for attackers to focus on such servers for e mail theft.”
