{"id":54322,"date":"2023-10-26T14:16:08","date_gmt":"2023-10-26T14:16:08","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35163\/Pro-Russian-Hackers-Target-XSS-In-Roundcube.html"},"modified":"2023-10-26T14:16:08","modified_gmt":"2023-10-26T14:16:08","slug":"pro-russian-hackers-target-xss-in-roundcube","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/","title":{"rendered":"Pro-Russian Hackers Target XSS In Roundcube"},"content":{"rendered":"<figure class=\"intro-image intro-left\"> <img decoding=\"async\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/05\/system-hacked-800x450.jpg\" alt=\"Pro-Russia hackers target inboxes with 0-day in webmail app used by millions\"><figcaption class=\"caption\">\n<div class=\"caption-credit\">Getty Images<\/div>\n<\/figcaption><\/figure>\n<aside id=\"social-left\" class=\"social-left\" aria-label=\"Read the comments or share this article\"> <a class=\"comment-count icon-comment-bubble-down\" href=\"https:\/\/arstechnica.com\/security\/2023\/10\/pro-russia-hackers-target-inboxes-with-0-day-in-webmail-app-used-by-millions\/?comments=1\"> <\/p>\n<h4 class=\"comment-count-before\">reader comments<\/h4>\n<p> <span class=\"comment-count-number\">38<\/span> <span class=\"visually-hidden\"> with <\/span> <\/a> <\/aside>\n<p> <!-- cache hit 124:single\/related:2214f7e5aabe881216f888d0a8f0b282 --><!-- empty --><\/p>\n<p>A relentless team of pro-Russia hackers has been exploiting a zero-day vulnerability in widely used webmail software in attacks targeting governmental entities and a think tank, all in Europe, researchers from security firm ESET said on Wednesday.<\/p>\n<p>The previously unknown vulnerability resulted from a critical cross-site scripting error in Roundcube, a server application used by <a href=\"https:\/\/roundcube.net\/about\/\">more than 1,000 webmail services<\/a> and millions of their end users. Members of a pro-Russia and Belarus hacking group tracked as Winter Vivern used the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Cross-site_scripting\">XSS bug<\/a> to inject JavaScript into the Roundcube server application. The injection was triggered simply by viewing a malicious email, which caused the server to send emails from selected targets to a server controlled by the threat actor.<\/p>\n<h2>No manual interaction required<\/h2>\n<p>\u201cIn summary, by sending a specially crafted email message, attackers are able to load arbitrary JavaScript code in the context of the Roundcube user\u2019s browser window,\u201d ESET researcher Matthieu Faou <a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers\/\">wrote<\/a>. \u201cNo manual interaction other than viewing the message in a web browser is required.\u201d<\/p>\n<p>The attacks began on October 11, and ESET detected them a day later. ESET reported the zero-day vulnerability to Roundcube developers on the same day, and they issued a <a href=\"https:\/\/github.com\/roundcube\/roundcubemail\/commit\/6ee6e7ae3\">patch<\/a> on October 14. The vulnerability is tracked as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-5631\">CVE-2023-5631<\/a> and affects Roundcube versions 1.6.x before 1.6.4, 1.5.x before 1.5.5, and 1.4.x before 1.4.15.<\/p>\n<p>Winter Vivern has been operating since at least 2020 and targets governments and think tanks, primarily in Europe and Central Asia. In March, the threat group was spotted <a href=\"https:\/\/arstechnica.com\/information-technology\/2023\/03\/pro-russian-hackers-target-elected-us-officials-supporting-ukraine\/\">targeting US government officials<\/a> who had voiced support for Ukraine in its bid to drive back Russia\u2019s invasion. Those attacks also exfiltrated targets\u2019 emails but exploited a separate, already-patched XSS in Zimbra Collaboration, a software package that\u2019s also used to host webmail portals.<\/p>\n<p>\u201cThis actor has been tenacious in its targeting of American and European officials as well as military and diplomatic personnel in Europe,\u201d a threat researcher from security firm Proofpoint said in March when disclosing the attacks exploiting the Zimbra vulnerability. \u201cSince late 2022, [Winter Vivern] has invested an ample amount of time studying the webmail portals of European government entities and scanning publicly facing infrastructure for vulnerabilities all in an effort to ultimately gain access to emails of those closely involved in government affairs and the Russia-Ukraine war.\u201d<\/p>\n<aside class=\"ad_wrapper\" aria-label=\"In Content advertisement\"> <span class=\"ad_notice\">Advertisement <\/span> <\/aside>\n<p>The email Winter Vivern used in the recent campaign came from the address team.management@outlook.com and had the subject \u201cGet started in your Outlook.\u201d<\/p>\n<figure class=\"image shortcode-img center full\"><img loading=\"lazy\" decoding=\"async\" alt=\"The email sent in the campaign.\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/winter-vivern-email-roundcube-exploit.jpeg\" width=\"582\" height=\"619\"><figcaption class=\"caption\">\n<div class=\"caption-text\">The email sent in the campaign.<\/div>\n<\/figcaption><\/figure>\n<p>Buried deep in the HTML source code was a malformed code element known as an SVG tag. It contained base-64 encoded text that, when decoded, translated to JavaScript that contained a command to run in the event an error occurred. Since the tag contained an intentional error, the malicious command was invoked, and the XSS bug ensured that Roundcube executed the resulting JavaScript.<\/p>\n<figure class=\"image shortcode-img center large\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/winter-vivern-html-source.png\" class=\"enlarge\" data-height=\"2208\" data-width=\"2507\" alt=\"HTML source code for the email, with a SVG tag at the end.\"><img loading=\"lazy\" decoding=\"async\" alt=\"HTML source code for the email, with a SVG tag at the end.\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/winter-vivern-html-source-640x564.png\" width=\"640\" height=\"564\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/winter-vivern-html-source-1280x1127.png 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-text\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/winter-vivern-html-source.png\" class=\"enlarge-link\" data-height=\"2208\" data-width=\"2507\">Enlarge<\/a> <span class=\"sep\">\/<\/span> HTML source code for the email, with a SVG tag at the end.<\/div>\n<\/figcaption><\/figure>\n<p>The final JavaScript payload instructed vulnerable servers to list folders and emails in the target\u2019s email account and to exfiltrate email messages to an attacker-controlled server by making HTTP requests to https:\/\/recsecas[.]com\/controlserver\/saveMessage.<\/p>\n<figure class=\"image shortcode-img center large\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/final-javacript-payload-roundcube.png\" class=\"enlarge\" data-height=\"1620\" data-width=\"2768\" alt=\"The final JavaScript payload.\"><img loading=\"lazy\" decoding=\"async\" alt=\"The final JavaScript payload.\" src=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/final-javacript-payload-roundcube-640x375.png\" width=\"640\" height=\"375\" srcset=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/final-javacript-payload-roundcube-1280x749.png 2x\"><\/a><figcaption class=\"caption\">\n<div class=\"caption-text\"><a href=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/10\/final-javacript-payload-roundcube.png\" class=\"enlarge-link\" data-height=\"1620\" data-width=\"2768\">Enlarge<\/a> <span class=\"sep\">\/<\/span> The final JavaScript payload.<\/div>\n<\/figcaption><\/figure>\n<p>Winter Vivern\u2019s previous success exploiting an already-patched Zimbra vulnerability should be a warning. Anyone using Roundcube as either a server admin or an end user should ensure the software is running a patched version.<\/p>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/35163\/Pro-Russian-Hackers-Target-XSS-In-Roundcube.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":54323,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[5585],"class_list":["post-54322","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blogs","tag-headlinehackergovernmentprivacyemailrussiadata-losscyberwar"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-26T14:16:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/05\/system-hacked-800x450.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Pro-Russian Hackers Target XSS In Roundcube\",\"datePublished\":\"2023-10-26T14:16:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/\"},\"wordCount\":576,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/pro-russian-hackers-target-xss-in-roundcube.jpg\",\"keywords\":[\"headline,hacker,government,privacy,email,russia,data loss,cyberwar\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/\",\"name\":\"Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/pro-russian-hackers-target-xss-in-roundcube.jpg\",\"datePublished\":\"2023-10-26T14:16:08+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/pro-russian-hackers-target-xss-in-roundcube.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/pro-russian-hackers-target-xss-in-roundcube.jpg\",\"width\":800,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/pro-russian-hackers-target-xss-in-roundcube\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,government,privacy,email,russia,data loss,cyberwar\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackergovernmentprivacyemailrussiadata-losscyberwar\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Pro-Russian Hackers Target XSS In Roundcube\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/","og_locale":"en_US","og_type":"article","og_title":"Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-10-26T14:16:08+00:00","og_image":[{"url":"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2023\/05\/system-hacked-800x450.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Pro-Russian Hackers Target XSS In Roundcube","datePublished":"2023-10-26T14:16:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/"},"wordCount":576,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2023\/10\/pro-russian-hackers-target-xss-in-roundcube.jpg","keywords":["headline,hacker,government,privacy,email,russia,data loss,cyberwar"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/","url":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/","name":"Pro-Russian Hackers Target XSS In Roundcube 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2023\/10\/pro-russian-hackers-target-xss-in-roundcube.jpg","datePublished":"2023-10-26T14:16:08+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2023\/10\/pro-russian-hackers-target-xss-in-roundcube.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2023\/10\/pro-russian-hackers-target-xss-in-roundcube.jpg","width":800,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/pro-russian-hackers-target-xss-in-roundcube\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,government,privacy,email,russia,data loss,cyberwar","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackergovernmentprivacyemailrussiadata-losscyberwar\/"},{"@type":"ListItem","position":3,"name":"Pro-Russian Hackers Target XSS In Roundcube"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=54322"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54322\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/54323"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=54322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=54322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=54322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}