- Eset reveals a larger campaign for cyber-espionage
- It was attributed to APT28, alias fancy bear
- The campaign geared several n-day and zero-day is missing
For years now, Russian state-sponsored threat players have been intercepted on email communication from governments across Eastern Europe, Africa and Latin America.
A new report from cybersecurity scientists ESET has found that the villains abused multiple zero-day and n-day vulnerabilities in webmail servers to steal emails.
ESET appointed the campaign “Roundpress” and says it started in 2023. Since then, Russian attackers sent known as Fancy Bear (alias APT28) phishing -e emails to victims in Greece, Ukraine, Serbia, Bulgaria, Romania, Camerun and Ecuador.
Government, military and other goals
E emails appear to be benign on the surface and discuss daily political events, but in the HTML body they would carry a malicious piece of JavaScript code. It would take advantage of a cross-site scripting (XSS) error in the Webmail Browser page used by the victim, creating invisible input fields where browsers and password managers are automatically filled in login credentials.
In addition, the code would read judgment or send http requests, collect e -mail messages, contacts, webmail settings, 2FA information and more. All information will then be exfiltered to a hard -coded C2 address.
Unlike traditional phishing messages that require some action on the victim’s side, these attacks only needed the victim to open and see the e -mail. Everything else was done in the background.
The silver lining here is that the payload has no persistence mechanism, so it only runs when the victim opens the E -mail. That said, once probably enough, as people rarely change their E -mail passwords so often.
ESET identified several shortcomings that were abused in this attack, including two XSS deficiencies in Roundcube, an XSS-LUNDAY in MDAEMON, an unknown XSS in Horde and an XSS error in Zimbra.
Victims include government organizations, military organizations, defense companies and critical infrastructure companies.
Via Bleeping computer
