Global Russian Hacking Campaign Steals Data from Government Agencies

A new report from cybersecurity researchers ESET has uncovered a sophisticated global hacking campaign, known as "RoundPress," carried out by Russian state-sponsored threat actors. This campaign, which started in 2023, has been targeting governments across Eastern Europe, Africa, and Latin America, leveraging multiple zero-day and n-day vulnerabilities in webmail servers to steal sensitive email communications.

The attackers, also known as Fancy Bear (AKA APT28), have been sending out phishing emails to victims in Greece, Ukraine, Serbia, Bulgaria, Romania, Cameroon, and Ecuador. These emails appear innocuous on the surface, discussing daily political events, but within their HTML body lies a malicious piece of JavaScript code designed to exploit cross-site scripting (XSS) flaws in webmail browser pages.

The code creates invisible input fields where browsers and password managers auto-fill login credentials, allowing the attackers to collect email messages, contacts, webmail settings, 2FA information, and more. All this information is then exfiltrated to a hardcoded Command and Control (C2) address. The payload has no persistence mechanism, meaning it only runs when the victim opens the email.

What's alarming about these attacks is that they don't require any action from the victim's end. Once opened and viewed, the attack proceeds in the background, leaving the victim none the wiser. While this approach might seem stealthy, it also means that the attackers are likely to have collected sufficient data from a single email.

According to ESET, multiple vulnerabilities were being exploited in this campaign, including two XSS flaws in Roundcube, an XSS zero-day in MDaemon, an unknown XSS in Horde, and an XSS flaw in Zimbra. These victims include government organizations, military organizations, defense companies, and critical infrastructure firms.

It's worth noting that the attackers have been using a range of tactics to remain undetected, including avoiding traditional phishing messages that require some action from the victim's side. This approach makes it easier for them to go unnoticed, at least initially.

A Growing Concern

The RoundPress campaign highlights the growing concern of state-sponsored hacking and the need for governments and organizations to take proactive measures to protect themselves against such threats. As cyberattacks continue to evolve, it's essential for individuals and organizations to stay vigilant and invest in robust security measures.

Protecting Yourself

If you're concerned about the potential impact of this campaign on your organization or personal data, here are some steps you can take:

  • Regularly update your email software and webmail servers to ensure you have the latest security patches.
  • Use strong passwords and enable two-factor authentication (2FA) for all accounts.
  • Be cautious when receiving unsolicited emails, even if they appear innocuous.
  • Implement a robust cybersecurity framework that includes monitoring and incident response plans.

By taking these steps, you can significantly reduce the risk of falling victim to such attacks. Remember, prevention is always better than reaction.

Awareness is Key

The RoundPress campaign serves as a stark reminder of the importance of cybersecurity awareness and education. By understanding the tactics and techniques used by attackers, individuals and organizations can better prepare themselves to defend against such threats.

Stay Informed

Stay up-to-date with the latest cybersecurity news and trends by following reputable sources and security experts. Remember, knowledge is power in the fight against cyberattacks.