Zero-day in Roundcube Webmail – Week in security with Tony Anscombe

This week, ESET research described how the Winter Vivern APT group has been exploiting a zero-day XSS vulnerability in Roundcube Webmail servers to target European governmental entities and a think tank. ESET researchers uncovered the attacks on October 11 while monitoring Winter Vivern's cyberespionage operations, which typically take aim at governments in Europe and Central Asia. They promptly reported the security loophole to the Roundcube team on October 12, who released security updates for the vulnerability four days later.

The …

aim apt attacks cyberespionage entities eset eset research exploiting monitoring october operations research researchers roundcube roundcube webmail security servers tank target uncovered vulnerability webmail week week in security winter winter vivern xss zero-day