Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

Recorded Future's Insikt Group reports that TAG-70, a Russia/Belarus-aligned threat actor, conducted an October 2023 campaign exploiting a Roundcube XSS (CVE-2023-5631) to deploy JavaScript loaders that capture credentials and exfiltrate email from government and military webmail servers across Ukraine, Georgia, Poland and other countries; the report includes malware payloads, hosting and C2 infrastructure, IoCs (domains, IPs, SHA256s), ATT&CK mappings, and recommended mitigations.