MalwarePublished 18 Mar 2026Updated 17 Apr 2026

Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

Source AlienVault OTX General

Description

An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and 2FA secret extraction. The primary target was identified as mail.dmsu.gov.ua, Ukraine's State Migration Service. Technical analysis shows significant overlaps with previously documented APT28 operations, while introducing new capabilities such as CSS-based side-channel attacks and browser credential theft. The toolkit's modular approach and sophisticated evasion techniques demonstrate APT28's evolving tactics in compromising webmail platforms for long-term intelligence gathering.

Impact

The impact of Operation Roundish on targeted organizations, especially government entities in Ukraine, is substantial. Successful exploitation allows attackers to harvest user credentials, including 2FA secrets, enabling unauthorized access to sensitive email accounts. This access facilitates persistent mail forwarding and bulk exfiltration of confidential communications, undermining confidentiality and potentially exposing classified or sensitive government information. Theft of address book data can lead to further spear-phishing campaigns and lateral movement within networks. The use of CSS-based side-channel attacks and browser credential theft represents a sophisticated method to bypass conventional security controls, increasing the difficulty of detection and remediation. For organizations worldwide using Roundcube webmail, especially those with similar configurations or vulnerabilities, there is a risk of similar exploitation if the toolkit or its variants are adapted. The campaign’s focus on long-term intelligence gathering and evasion techniques means compromised systems may remain under attacker control for extended periods, amplifying the potential damage. Additionally, the targeting of government entities in a geopolitically sensitive region underscores the threat’s strategic importance and potential to disrupt governmental operations and national security.

Defensive guidance

1. Conduct a thorough security audit of all Roundcube webmail installations, focusing on patching known vulnerabilities and applying the latest security updates. 2. Implement strict input validation and output encoding to prevent XSS and CSS injection attacks, including Content Security Policy (CSP) headers to restrict script execution. 3. Monitor mail server logs and user activity for signs of unusual mail forwarding rules, bulk email exfiltration, or unauthorized access attempts. 4. Deploy multi-factor authentication solutions that are resistant to credential theft, such as hardware tokens or FIDO2, and regularly review 2FA configurations. 5. Use endpoint detection and response (EDR) tools to identify and block Go-based implants and other malicious payloads. 6. Restrict access to webmail administration interfaces and enforce strong authentication and network segmentation. 7. Regularly update and audit DNS and domain name system configurations to detect and block malicious domains related to the threat. 8. Educate users on phishing risks and suspicious email indicators, especially in high-risk environments. 9. Employ threat intelligence feeds to detect and block known indicators of compromise (IOCs) such as IP addresses, hashes, and domains associated with Operation Roundish. 10. Establish incident response plans tailored to webmail compromise scenarios to enable rapid containment and remediation.

Indicators of compromise

Domains 4

zhblz.com
a.zhblz.com
blog.pentagonteam.com
docs.goog1e.com.spreadsheets.d.1ipevana4hglaeksstshboujdk.zhblz.com

URLs 1

http://zhblz.com/zJ2w9x

IP addresses 3

203.161.50.145
106.51.89.49
217.146.67.241

Hashes 5

4b3e139c122df9fbc08442b7823ebde9
e76f54b7b98ba3a08f39392e6886a9cb
743f7ad2d7802a1f951899d6175df69622e51846
dc2983fbc868097c78f5bccea43eb5ac4b81aaf6
e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Mar 2026, 11:28 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details