Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine

Reported 18 Mar 2026 by otx · Severity: medium

An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, pers