TLDR Tech / InfoSec
Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine
Hunt.io uncovered an exposed open directory on 203.161.50[.]145 containing a complete APT28 Roundcube exploitation toolkit. This toolkit overlaps with 14 TTPs observed in Operation RoundPress, targeting Ukraine's State Migration Service using XSS payloads that simultaneously harvest credentials through hidden autofill forms, install persistent Sieve forwarding rules to advenwolf@proton[.]me, bulk exfiltrate emails via the viewsource API, extract TOTP secrets, steal address books, and deploy Chrome/Firefox credential stealers. New capabilities not previously linked to APT28 include a CSS selector side-channel attack for CSRF token extraction, a Go-based Linux backdoor with cron, systemd, and SELinux persistence mechanisms, along with container escape detection scripts. These scripts indicate regular targeting of Docker and Kubernetes environments. Defenders using Roundcube should immediately review all Sieve forwarding rules, implement a strict Content Security Policy that blocks eval() and external resource loading, monitor for bulk viewsource API requests and CSS @import chains with incrementing query parameters, and consider password resets insufficient without full 2FA re-enrollment and session invalidation.
Read the full story