The cybersecurity researchers at Proofpoint have disclosed a new phishing campaign from the Russian APT group known as Winter Vivern, TA473, and UAC-0114. The group has been exploiting a vulnerability in Zimbra Collaboration software to hack the emails of government agencies in different European countries.
Although it is yet unproven which nation-state supports this APT group, security researchers believe that its activities are in alliance with the interests of Belarus and Russia.
For your information, Zimbra Collaboration is a business collaboration and email platform that allows users to send and receive emails, and manage contacts, calendars, and tasks. It can be used on-premise or in the cloud and is used by governments, educational institutions, service providers, and businesses.
How Does the Group Target Victims?
Winter Vivern’s modus operandi entails sending out phishing emails impersonating the target organizations or their parent organizations’ employees with political affiliation to the government.
These emails are sent from email IDs having compromised domains or hosted on vulnerable WordPress websites. The email message includes a link to a resource of the target organization’s official website.
However, this is a spoofed link as it redirects the recipient to a payload hosted on the attacker’s domain or a credential-stealing web page. This technique’s efficacy is now enhanced with a cross-site scripting vulnerability found in Zimbra.
APT Group Exploiting Zimbra Vulnerability
Zimbra is an open-source, on-premise and Cloud enabled business collaboration and email platform used by “hundreds of millions of mailboxes across 140 countries,” as per its website. The service is used by governments, educational institutions, service providers, and small to medium-sized businesses.
Proofpoint researchers noted that Winter Vivern is targeting the medium severity Zimbra vulnerability tracked as CVE-2022-27926, which Zimbra already patched in version 9.0.0 Patch 24, one year ago. The XSS flaws can allow threat actors to create links with appended code, which execute malware inside the browser when opened.
Modus Operandi and Possible Dangers
In the current campaign, the hackers target government agencies through vulnerable Zimbra installations/web interfaces and send phishing emails with links that exploit the XSS flaw and execute encoded JavaScript. When it is executed by the browser, a larger JavaScript payload is fetched from the attackers’ server and executed on the website in what’s called a cross-site request forgery attack.
Attackers can now steal the victims’ usernames, passwords, and active CSRF tokens obtained from a cookie and transfer the information to their server. After obtaining login credentials and tokens, the malicious JavaScript uses hardcoded URLs to hijack the email portal.
“In some instances, researchers observed TA473 specifically targeting RoundCube webmail request tokens as well. This detailed focus on which webmail portal is being run by targeted European government entities indicates the level of reconnaissance that TA473 conducts before delivering phishing emails to organizations,” Proofpoint’s report read.
“These labour-intensive customized payloads allow actors to steal usernames, passwords, and store active session and CSRF tokens from cookies facilitating the login to publicly facing webmail portals belonging to NATO-aligned organizations,” Proofpoint noted.
Who Are Vulnerable?
Organizations that haven’t patched their Zimbra products in the past year are vulnerable to TA473 attacks. To prevent such attacks, it is important to restrict resources on publicly available webmail portals. This would prevent APT groups from engineering customized scripts that can steal credentials and log into the victim’s webmail accounts.
Winter Vivern’s Past Victims
The group’s past victims were located in India, Vietnam, Lithuania, Slovakia, and the Vatican. Sentinel Labs reported earlier in March that the group’s recent targets include Italian and Ukrainian Foreign Affairs ministries, Polish government agencies, Indian government officials, and telecommunication firms that support Ukraine in the war.
According to Proofpoint’s previous research, this group targeted elected government representatives in the US and their staffers.
