Hunt.io Links Roundcube Exploitation Toolkit Targeting Ukraine to APT28

Mar 11, 2026 · Original article ↗

Summary

Hunt.io says an exposed server revealed a Roundcube exploitation toolkit it assesses with medium-high confidence is linked to APT28. The toolkit enables credential theft, mailbox exfiltration, forwarding-rule persistence, and browser credential theft.

Key points

Hunt.io found an exposed directory in January 2026 containing a Roundcube exploitation toolkit, C2 components, payloads, and operator artifacts.
The researchers assess with medium-high confidence that the activity aligns with APT28, citing 14 overlaps with ESET-documented Operation RoundPress.
Operator artifacts indicate targeting of mail.dmsu.gov.ua, Ukraine’s State Migration Service; the toolkit uses XSS and phishing to capture credentials and mailbox data.
Its capabilities include hidden-form password-manager capture, email and address-book theft, TOTP secret extraction, and Sieve rules that forward incoming mail to an external address.
A CSS side-channel module and Chrome and Firefox credential theft tools extend the toolkit beyond previously documented APT28 webmail activity.
A Go implant recovered from a compromised Ukrainian web application supports persistence through cron, systemd, and an SELinux policy mechanism.
Hunt.io recommends auditing external mail-forwarding rules, revoking sessions and resetting MFA secrets on compromised accounts, and monitoring for the identified implant and network indicators.

Article Details

Attack Vectors: Malicious emails trigger XSS payloads when opened in the targeted webmail interface, launching credential harvesting, mailbox collection, contact theft, MFA-secret extraction, and forwarding-rule creation.
A cloned webmail login page captures credentials and redirects visitors to a lure PDF.
Invisible autocomplete-enabled login fields capture browser password-manager autofill values when the victim clicks the page.
Server-side mail forwarding provides continued email exfiltration after password changes, session revocation, or vulnerability patching.
CSS selector matching and chained imports progressively leak DOM attribute values through external callbacks; the researchers assess that CSRF tokens or email UIDs are likely targets.
Browser credential collection includes a PowerShell-based delivery chain and server-side decryption of stolen encrypted credentials.
Operator history records SSH pivoting, reverse-shell deployment, payload staging, and container-environment checks.
A recovered Linux implant supports cron and service persistence and loads a custom security-policy module to permit its execution.
Defensive Notes: Audit and remove unauthorized Sieve and ManageSieve forwarding rules; password resets alone do not stop server-side forwarding.
For compromised accounts, revoke and re-enroll MFA credentials, invalidate sessions, and verify that no unauthorized forwarding filters remain.
Apply webmail security updates and enforce a strict Content Security Policy blocking eval(), inline scripts, and untrusted external resources.
Disable ManageSieve when forwarding is not a business requirement.
Monitor outbound SMTP for unexpected external forwarding, HTTP requests during email rendering, chained CSS imports with incrementing parameters, and bulk viewsource API requests.
Look for the /zJ2w9x?log= URI pattern and the custom HTTP header secure: bigdick.
Inspect /etc/crontab for /.img, /boot for linux.service, and installed SELinux modules for my-Systemimgconf; block the recovered implant hash.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`zhblz[.]com`	Undefanged primary C2 domain appearing in captions and exfiltration descriptions.
EMAIL	`advenwolf@proton[.]me`	Undefanged forwarding destination used to receive victims' incoming email.
EMAIL	`srezoska@skiff[.]com`	Malicious forwarding destination documented for the compared SpyPress activity.
HOSTNAME	`a[.]zhblz[.]com`	Undefanged CSS side-channel hostname used for /leak and /end callbacks.
HOSTNAME	`blog[.]pentagonteam[.]com`	Undefanged hostname of the compromised web application whose recovered archive contained the httd implant.
HOSTNAME	`docs[.]goog1e[.]com[.]spreadsheets[.]d[.]1ipevana4hglaeksstshboujdk[.]zhblz[.]com`	C2-associated hostname mimicking Google Spreadsheets URLs for credential phishing.
IPV4	`130[.]61[.]233[.]105`	Operator infrastructure identified as a long-standing SSH pivot host on Oracle Cloud.
IPV4	`203[.]161[.]50[.]145`	Undefanged C2 hosting address explicitly shown in infrastructure figure captions.
MD5	`4b3e139c122df9fbc08442b7823ebde9`	MD5 of the recovered httd Go ELF backdoor.
SHA256	`e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8`	SHA-256 of the recovered httd Go ELF backdoor.