A Russia-linked menace actor has been attributed to a cyber espionage operation focusing on webmail servers resembling Roundcube, Horde, MDaemon, and Zimbra through cross-site scripting (XSS) vulnerabilities, together with a then-zero-day in MDaemon, in accordance with new findings from ESET.
The exercise, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity firm. It has been attributed with medium confidence to the Russian state-sponsored hacking group tracked as APT28, which can be known as BlueDelta, Fancy Bear, Combating Ursa, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422.
“The final word objective of this operation is to steal confidential knowledge from particular electronic mail accounts,” ESET researcher Matthieu Faou stated in a report shared with The Hacker Information. “Most victims are governmental entities and protection corporations in Jap Europe, though we now have noticed governments in Africa, Europe, and South America being focused as effectively.”
This isn’t the primary time APT28 has been tied to assaults exploiting flaws in webmail software program. In June 2023, Recorded Future detailed the menace actor’s abuse of a number of flaws in Roundcube (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to conduct reconnaissance and knowledge gathering.
Since then, different menace actors like Winter Vivern and UNC3707 (aka GreenCube) have additionally focused electronic mail options, together with Roundcube in numerous campaigns through the years. Operation RoundPress’ ties to APT28 stem from overlaps within the electronic mail deal with used to ship the spear-phishing emails and similarities in the best way sure servers have been configured.
A majority of the targets of the marketing campaign in 2024 have been discovered to be Ukrainian governmental entities or protection corporations in Bulgaria and Romania, a few of that are producing Soviet-era weapons to be despatched to Ukraine. Different targets embody authorities, army, and educational organizations in Greece, Cameroon, Ecuador, Serbia, and Cyprus.
The assaults entail the exploitation of XSS vulnerabilities in Horde, MDaemon, and Zimbra to execute arbitrary JavaScript code within the context of the webmail window. It is value noting that CVE-2023-43770 was added by the U.S. Cybersecurity and Infrastructure Safety Company (CISA) to its Identified Exploited Vulnerabilities (KEV) catalog in February 2024.
Whereas the assaults focusing on Horde (an unspecified outdated flaw mounted in Horde Webmail 1.0 launched in 2007), Roundcube (CVE-2023-43770), and Zimbra (CVE-2024-27443) leveraged security defects already identified and patched, the MDaemon XSS vulnerability is assessed to have been utilized by the menace actor as a zero-day. Assigned the CVE identifier CVE-2024-11182 (CVSS rating: 5.3), it was patched in model 24.5.1 final November.
“Sednit sends these XSS exploits by electronic mail,” Faou stated. “The exploits result in the execution of malicious JavaScript code within the context of the webmail shopper net web page operating in a browser window. Due to this fact, solely knowledge accessible from the sufferer’s account might be learn and exfiltrated.”
Nevertheless, for the exploit to achieve success, the goal have to be satisfied to open the e-mail message within the susceptible webmail portal, assuming it is in a position to bypass the software program’s spam filters and land on the person’s inbox. The contents of the e-mail themselves are innocuous, because the malicious code that triggers the XSS flaw resides throughout the HTML code of the e-mail message’s physique and, due to this fact, will not be seen to the person.
Profitable exploitation results in the execution of an obfuscated JavaScript payload named SpyPress that comes with the power to steal webmail credentials and harvest electronic mail messages and get in touch with data from the sufferer’s mailbox. The malware, regardless of missing a persistence mechanism, will get reloaded each time the booby-trapped electronic mail message is opened.
“As well as, we detected just a few SpyPress.ROUNDCUBE payloads which have the power to create Sieve guidelines,” ESET stated. “SpyPress.ROUNDCUBE creates a rule that can ship a duplicate of each incoming electronic mail to an attacker-controlled electronic mail deal with. Sieve guidelines are a characteristic of Roundcube and due to this fact the rule might be executed even when the malicious script is now not operating.”
The gathered data is subsequently exfiltrated through an HTTP POST request to a hard-coded command-and-control (C2) server. Choose variants of the malware have additionally been discovered to seize login historical past, two-factor authentication (2FA) codes, and even create an software password for MDAEMON to retain entry to the mailbox even when the password or the 2FA code will get modified.
“Over the previous two years, webmail servers resembling Roundcube and Zimbra have been a significant goal for a number of espionage teams resembling Sednit, GreenCube, and Winter Vivern,” Faou stated. “As a result of many organizations do not preserve their webmail servers updated and since the vulnerabilities might be triggered remotely by sending an electronic mail message, it is rather handy for attackers to focus on such servers for electronic mail theft.”
