A relentless team of pro-Russia hackers has been exploiting a zero-day vulnerability in widely used webmail software in attacks targeting governmental entities and a think tank, all in Europe, researchers from security firm ESET said on Wednesday.
No manual interaction required
The attacks began on October 11, and ESET detected them a day later. ESET reported the zero-day vulnerability to Roundcube developers on the same day, and they issued a patch on October 14. The vulnerability is tracked as CVE-2023-5631 and affects Roundcube versions 1.6.x before 1.6.4, 1.5.x before 1.5.5, and 1.4.x before 1.4.15.
Winter Vivern has been operating since at least 2020 and targets governments and think tanks, primarily in Europe and Central Asia. In March, the threat group was spotted targeting US government officials who had voiced support for Ukraine in its bid to drive back Russia’s invasion. Those attacks also exfiltrated targets’ emails but exploited a separate, already-patched XSS in Zimbra Collaboration, a software package that’s also used to host webmail portals.
“This actor has been tenacious in its targeting of American and European officials as well as military and diplomatic personnel in Europe,” a threat researcher from security firm Proofpoint said in March when disclosing the attacks exploiting the Zimbra vulnerability. “Since late 2022, [Winter Vivern] has invested an ample amount of time studying the webmail portals of European government entities and scanning publicly facing infrastructure for vulnerabilities all in an effort to ultimately gain access to emails of those closely involved in government affairs and the Russia-Ukraine war.”
The email Winter Vivern used in the recent campaign came from the address [email protected] and had the subject “Get started in your Outlook.”
Winter Vivern’s previous success exploiting an already-patched Zimbra vulnerability should be a warning. Anyone using Roundcube as either a server admin or an end user should ensure the software is running a patched version.