Threats Tagged 'roundcube'

An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and 2FA secret extraction. The primary target was identified as mail.dmsu.gov.ua, Ukraine's State Migration Service. Technical analysis shows significant overlaps with previously documented APT28 operations, while introducing new capabilities such as CSS-based side-channel attacks and browser credential theft. The toolkit's modular approach and sophisticated evasion techniques demonstrate APT28's evolving tactics in compromising webmail platforms for long-term intelligence gathering.

MediumMalwareUkraineUnited StatesUnited Kingdom+7#css injection#httd#go implant

The UNC1151 threat actor is exploiting a critical vulnerability (CVE-2024-42009) in the Roundcube webmail client through a spearphishing campaign targeting primarily Polish organizations. Malicious JavaScript embedded in phishing emails installs a stealthy Service Worker in victims' browsers upon simply opening the email, intercepting login credentials and exfiltrating them to attacker-controlled infrastructure without further user interaction. A second vulnerability (CVE-2025-49113) may be chained to increase persistence and impact. Stolen credentials enable attackers to access mailboxes, harvest address books, and propagate phishing internally, facilitating lateral movement. The attack bypasses many traditional endpoint defenses and is difficult to detect due to the abuse of browser Service Workers. The campaign also threatens neighboring Central European countries with significant Roundcube deployments. Organizations are urged to patch vulnerabilities, monitor for unusual Service Worker activity, enforce multi-factor authentication, and enhance email filtering to mitigate risks.

MediumCampaignPolandGermanyCzechia+3#roundcube#cve-2024-42009#spearphishing