Winter Vivern (aka TA473 and UAC-0114), a threat actor strongly aligned with Russia, is once again making headlines for targeting government organizations in Europe.
The group was found to exploit a zero-day vulnerability in the Roundcube webmail servers to compromise the targeted systems remotely.
The vulnerability tracked as CVE-2023-5631 is a Cross-Site scripting issue in RoundCube, which could be exploited remotely by sending a specially crafted email message. The vulnerability affects Roundcube versions 1.6.x before 1.6.4, 1.5.x before 1.5.5, and 1.4.x before 1.4.15.
In this campaign, the emails were sent from the address team.managment@outlook[.]com with the subject line ‘Get started in your Outlook’. These emails included a malicious SVG file that contained a base64-encoded payload.
Winter Vivern has been exploiting previously known vulnerabilities in RoundCube and Zimbra email servers as part of its infection process to launch attacks against European entities. It abused CVE-2020-35730 in RoundCube in a campaign between August and September.
Despite the low sophistication of the group’s toolset, Winter Vivern remains a significant threat to organizations in Europe. Hence, it is recommended to apply the latest security patches to mitigate the risk of such attacks. Refer to IoCs containing file hashes and malicious domains to block the threat at the initial stage.
Indicators of Compromise