Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1059.007 JavaScript |
GroupWinter Vivern | Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers. |
| T1083 File and Directory Discovery |
GroupWinter Vivern | Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers. |
| T1114.001 Local Email Collection |
GroupWinter Vivern | Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers. |
| T1140 Deobfuscate/Decode Files or Information |
GroupWinter Vivern | Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages. |
| T1190 Exploit Public-Facing Application |
GroupWinter Vivern | Winter Vivern has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the "Follina" vulnerability. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
