Threats Tagged 'unc1151'

The UNC1151/Ghostwriter group is conducting high-intensity phishing campaigns targeting Gmail accounts of Polish citizens since March 2026. The campaigns primarily target individuals in political and public life, prominent positions, researchers, journalists, public administration and law enforcement employees, and their associates. Attackers use fraudulent emails impersonating Gmail administrators, claiming suspicious activity or policy violations to pressure victims into verifying their accounts. The phishing infrastructure captures login credentials and two-factor authentication codes through fake login panels. The group utilizes dedicated domains, Netlify subdomains, and compromised websites to host phishing pages. Campaigns run primarily on weekdays with new domains appearing almost daily, demonstrating persistent operational tempo against Polish targets.

MediumPhishingPoland#unc1151#gmail#phishing

The UNC1151 threat actor is exploiting a critical vulnerability (CVE-2024-42009) in the Roundcube webmail client through a spearphishing campaign targeting primarily Polish organizations. Malicious JavaScript embedded in phishing emails installs a stealthy Service Worker in victims' browsers upon simply opening the email, intercepting login credentials and exfiltrating them to attacker-controlled infrastructure without further user interaction. A second vulnerability (CVE-2025-49113) may be chained to increase persistence and impact. Stolen credentials enable attackers to access mailboxes, harvest address books, and propagate phishing internally, facilitating lateral movement. The attack bypasses many traditional endpoint defenses and is difficult to detect due to the abuse of browser Service Workers. The campaign also threatens neighboring Central European countries with significant Roundcube deployments. Organizations are urged to patch vulnerabilities, monitor for unusual Service Worker activity, enforce multi-factor authentication, and enhance email filtering to mitigate risks.

MediumCampaignPolandGermanyCzechia+3#roundcube#cve-2024-42009#spearphishing