Cyberespionage Tactics in Webmail Exploitation

Explore real-world cyberespionage attacks through this 30-minute conference talk examining how threat actors exploit cross-site scripting (XSS) vulnerabilities in webmail portals to steal sensitive communications from high-value targets. Learn about ESET's two-year investigation into webmail exploitation tactics, including the discovery of zero-day vulnerabilities in Roundcube and MDaemon, as well as the identification of N-day vulnerabilities across Roundcube, Zimbra, and Horde platforms. Discover how webmail portals become particularly vulnerable due to their core function of displaying untrusted HTML content from email messages within web browser contexts. Examine detailed technical analysis of exploits and JavaScript payloads deployed by three major cyberespionage groups: Russia-aligned Sednit and GreenCube, and Belarus-aligned Winter Vivern. Understand the sophisticated methods these groups use to leverage XSS vulnerabilities for stealing email messages from government officials and other critical targets, bridging the gap between theoretical XSS knowledge and actual attack implementations in the wild.