Russia-linked APT TAG-70 targets European government and military mail servers exploiting Roundcube XSS

An APT group, tracked as TAG-70, linked to Belarus and Russia exploited XSS flaws in Roundcube webmail servers to target over 80 organizations.

Researchers from Recorded Future’s Insikt Group identified a cyberespionage campaign carried out by an APT group, tracked as TAG-70, linked to Belarus and Russia. The nation-state actors are known to carry out cyber-espionage against targeting government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020.

Between October and December 2023, TAG-70 exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers in attacks aimed at over 80 organizations, primarily in Georgia, Poland, and Ukraine.

“TAG70 has demonstrated a high level of sophistication in its attack methods. The threat actors leveraged social engineering techniques and exploited cross-site scripting vulnerabilities in Roundcube webmail servers to gain unauthorized access to targeted mail servers, successfully bypassing the defenses of government and military organizations.” reads the report published Recorded Future’s Insikt Group.

The researchers noticed similarities between this campaign and other activities conducted by other Russia-linked groups, such as BlueDelta (APT28) and Sandworm. These APT groups previously targeted email solutions, including Roundcube and Zimbra.

The compromise of email servers poses a substantial risk, especially during a conflict such as Russia-Ukraine. Threat actors can target email servers to gather intelligence about adversaries’ war efforts, diplomatic relationships, and coalition partnerships.

The attacks aimed at Iranian embassies in Russia and the Netherlands demonstrate a broader geopolitical interest in assessing Iran’s diplomatic activities, particularly its support for Russia in the context of the Ukrainian conflict. Similarly, the espionage against Georgian government entities reflects an interest in monitoring Georgia’s pursuits to access the European Union (EU) and NATO.

On July 27, 2023, the researchers a malicious JavaScript that was acting as a second-stage loader used by TAG70 previous to the exploitation of Roundcube issue. ESET researchers also detailed the same attack chain.

The JavaScript is loaded through cross-site scripting (XSS) from a malicious email and it decoded a Base64-encoded JavaScript payload (jsBodyBase64). Then the payload is inserted into the Document Object Model (DOM) of the Roundcube webpage within a newly created script tag.

The researchers recommend reading the detailed analysis of the recent TAG-70 campaign here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Roundcube)