Russian Hackers Hit Mail Servers in Europe for Political and Military Intel

Recorded Future’s Insikt Group attributes an espionage campaign to TAG-70 (aka Winter Vivern) that exploited a Roundcube webmail XSS/zero-day (CVE-2023-563) and used spearphishing and JavaScript payloads to compromise mail servers across ~80 organizations in Europe — notably Ukraine, Georgia, and Poland — to collect political and military intelligence, including targeting embassies and critical infrastructure between October and December 2023.