Cyber Security

Roundcube Webmail servers under attack – Week in security with Tony Anscombe


The zero-day exploit deployed by the Winter Vivern APT group only requires that the target views a specially crafted message in a web browser

This week, ESET research described how the Winter Vivern APT group has been exploiting a zero-day XSS vulnerability in Roundcube Webmail servers to target European governmental entities and a think tank. ESET researchers uncovered the attacks on October 11th while monitoring Winter Vivern’s cyberespionage operations, which typically take aim at governments in Europe and Central Asia. They promptly reported the security loophole to the Roundcube team on October 12th, who released security updates for the vulnerability four days later.

The security flaw (CVE-2023-5631) can be exploited via specially crafted email messages. Organizations are strongly recommended to update their installations of Roundcube Webmail to the latest version post-haste.

Find out more in the video and in our blogpost.

Connect with us on FacebookTwitterLinkedIn and Instagram.

Articles You May Like

Prosus slashes valuation of India’s Byju’s below $3 billion
As Temu shakes up global ecommerce, PDD nears overtaking Alibaba
AWS reInvent: Everything Amazon’s announced, from new AI tools to LLM updates and more
Ukraine detains Victor Zhora, former top government cyber official
Okta: Support system breach affected all customers

Leave a Reply

Your email address will not be published. Required fields are marked *