Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and 2FA secret extraction. The primary target was identified as mail.dmsu.gov.ua, Ukraine's State Migration Service. Technical analysis shows significant overlaps with previously documented APT28 operations, while introducing new capabilities such as CSS-based side-channel attacks and browser credential theft. The toolkit's modular approach and sophisticated evasion techniques demonstrate APT28's evolving tactics in compromising webmail platforms for long-term intelligence gathering.

Pulse ID: 69ba83b93cb449af00474243
Pulse Link: https://otx.alienvault.com/pulse/69ba83b93cb449af00474243
Pulse Author: AlienVault
Created: 2026-03-18 10:51:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#2FA #APT28 #Browser #CredentialHarvesting #CyberSecurity #Email #Government #ICS #InfoSec #OTX #OpenThreatExchange #RAT #UK #Ukr #Ukraine #Ukrainian #Webmail #XSS #bot #AlienVault