XSS napadi na mail servere organizacija u Srbiji

[Jana]

Kompanija ESET je napravila izveštaj o špijuniranju vlada i slabosti u državnim sistema.

In June 2023, we discovered a set of spearphishing campaigns, which we named Operation RoundPress, exploiting an XSS vulnerability in Roundcube (CVE-2020-35730); see an example in Figure 6. Using this vulnerability, attackers are able to inject malicious JavaScript code into the victim’s Roundcube webmail server. The injected code is able to steal emails, address books, and create forwarding rules to steal incoming emails. This campaign was also documented by CERT-UA and Recorded Future.

In August and September 2023, we detected an updated version of Operation RoundPress spearphishing, exploiting the same XSS vulnerability.
This campaign was targeting organizations in Serbia, Greece, Poland, and Ukraine.