CERT Polska has observed a spear phishing campaign targeting Polish entities this week. The threat actor attempted to exploit the CVE-2024-42009 vulnerability, which allows JavaScript code to be executed when an email message is opened, with the aim of stealing user credentials.
It's also worth noting that a new vulnerability in Roundcube, CVE-2025-49113, was discovered just this week. It allows an authenticated attacker to execute code and potentially take over the entire webmail server. While we haven't observed any signs of this vulnerability being exploited, it could be combined with an account compromise vulnerability to form a highly effective attack chain.
Based on technical indicators, we attribute this campaign to a cluster of UNC1151 activity with high confidence. According to publications by Mandiant and Google , UNC1151 is associated with the Belarusian government while other sources connect it with Russian intelligence services.
The sent messages contained an eye-catching subject that was meant to persuade the recipient to quickly act upon the message. Opening the email message was all that was needed in order to exploit the already public Roundcube vulnerability - CVE-2024-42009.
Email's content translated to English:
The exploited vulnerability is caused by a bug in Roundcube that allows the attacker to execute arbitrary JavaScript in the victim's browser context after they open a specially crafted email message.
Email clients accessible through Internet browsers, such as Roundcube, must allow users to view email messages consisting of some of the HTML features. At the same time, however, readers must be protected from malicious code and site-altering elements that could deceive them.
The worst possible result of running untrusted code is a complete compromise of users session and/or credentials.
In order to safely display the HTML message, the email client has to sanitize it and remove dangerous elements, such as tags and attributes that could be used to execute JavaScript code.
At its core, the described sanitization process is surprisingly non-trivial, and new bypass methods are constantly being discovered in different products.
CERT Polska identified several such bypasses while examining the security of Polish email providers in 2021–2022. Over 20 vulnerabilities were found and reported, including one in Roundcube.
The vulnerability that was exploited - CVE-2024-42009, had been discovered by security engineers from Sonar last year .
Since the vulnerability had already been patched in recent versions of Roundcube, the installation has to be outdated at the time of the attack.
While we have seen XSS vulnerabilities being exploited by different APT groups (APT28, Winter Vivern) in the past, this campaign marks our first recorded exploitation attempt of CVE-2024-42009 and the first attack of such type by UNC1151 . It's also worth noting the use of the Service Workers feature, which we describe in the Malicious code section of this article.
The malicious code employed by the attackers consisted of two distinct parts. The first part is executed using the exploited vulnerability and installs a Service Worker in the victim's browser, which runs the second JavaScript portion from the attachment.
Service Workers are a browser feature that allows JavaScript to run in the background and intercept requests reaching out to the domain where the worker has been initialized.
After successfully installing the Service Worker in a victim's browser, the user is then redirected to the legitimate webmail login page of their organization . This is where the second code portion comes into play. The Service Worker captures all legitimate login attempts and, in addition to logging the user in, also sends a copy of the credentials to a server controlled by the attackers.
According to incident analysis in one of the affected entities, after successfully harvesting user credentials, the attackers then move on to analyze the mailbox contents, download the address book, and in some cases, use the account to disseminate further phishing messages.
While we haven't seen any signs of such exploitation, it's worth noting that a new vulnerability in Roundcube — discovered just this week (CVE-2025-49113) — could be combined with an account compromise vulnerability to form a highly effective attack chain.
All organisations that use Roundcube should:
Organisations that were targeted in the described campaign should:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
