This threat involves a spearphishing campaign attributed to the threat actor UNC1151 targeting Polish entities by exploiting a critical vulnerability in the Roundcube webmail client, specifically CVE-2024-42009. Roundcube is a widely used open-source webmail solution deployed by many organizations for email access. The attack vector leverages malicious JavaScript embedded in spearphishing emails that, when opened, execute code allowing the installation of a Service Worker in the victim's browser. This Service Worker operates stealthily to intercept login attempts to Roundcube, capturing user credentials and transmitting them to attacker-controlled infrastructure. The exploit allows code execution simply upon opening the email, bypassing traditional security controls that rely on user interaction beyond opening the message. Additionally, a newly discovered vulnerability, CVE-2025-49113, in Roundcube may be chained with CVE-2024-42009 to create a more effective and persistent attack vector, potentially increasing the scope and impact of the campaign. After credential theft, UNC1151 uses the compromised accounts to analyze mailboxes, extract address books, and propagate further phishing emails internally, facilitating lateral movement and expanding their foothold within targeted organizations. The campaign employs advanced tactics such as service worker abuse (T1059.007), credential access (T1078), and spearphishing (T1566.001). Indicators of compromise include specific IP addresses, domains, URLs, and file hashes linked to the campaign. Organizations running Roundcube installations are urged to update their software promptly and conduct thorough log reviews for signs of compromise, such as unusual service worker registrations or unexpected login patterns.

For European organizations, especially those in Poland and neighboring countries with significant Roundcube deployments, this threat poses a substantial risk to the confidentiality and integrity of email communications. Compromise of user credentials can lead to unauthorized access to sensitive corporate communications, intellectual property, and personally identifiable information. The attackers' ability to harvest address books and send further phishing emails internally increases the risk of widespread compromise within an organization, potentially leading to data breaches, financial fraud, and reputational damage. The exploitation of browser-based service workers for credential interception is particularly concerning as it bypasses many traditional endpoint security measures. Given the strategic importance of email systems in business operations and government communications, disruption or compromise could also impact availability indirectly through operational disruptions and incident response activities. The campaign's focus on Polish entities suggests a targeted geopolitical motive, but the underlying vulnerabilities and attack techniques could be leveraged against other European organizations using Roundcube, especially those with similar configurations or lacking timely patching.

1. Immediate patching of Roundcube installations to address CVE-2024-42009 and CVE-2025-49113 vulnerabilities is critical. Organizations should monitor official Roundcube releases and apply updates without delay. 2. Conduct comprehensive log analysis focusing on unusual service worker registrations, anomalous login attempts, and suspicious outbound connections to known malicious domains or IPs such as those identified in the indicators. 3. Implement browser security policies that restrict or monitor service worker registrations, especially in corporate environments where webmail is accessed. 4. Enhance email filtering and spearphishing detection capabilities to identify and quarantine malicious emails before reaching end users, leveraging threat intelligence feeds that include UNC1151 indicators. 5. Enforce multi-factor authentication (MFA) for webmail access to reduce the risk of credential misuse even if passwords are compromised. 6. Educate users on the risks of spearphishing and the importance of reporting suspicious emails, emphasizing that opening an email alone can trigger exploitation. 7. Segment email infrastructure and restrict internal email forwarding to limit the spread of phishing campaigns within the organization. 8. Regularly audit and restrict permissions on mailboxes and address books to minimize data exposure in case of compromise.