{
  "Event": {
    "analysis": "1",
    "date": "2026-03-18",
    "extends_uuid": "",
    "info": "[Threat Intel] Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine",
    "protected": false,
    "publish_timestamp": "1775231565",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1775231565",
    "uuid": "96f3eeee-56ee-498d-b892-462f3237c482",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#cf6788",
        "local": false,
        "name": "misp-galaxy:producer=\"Hunt.io\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#690e1a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Container and Resource Discovery - T1613\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#f6f176",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Account - T1087.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#866c0c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Active Scanning - T1595\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Portal Capture - T1056.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#e556be",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Forwarding Rule - T1114.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-Factor Authentication Interception - T1111\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#013748",
        "local": false,
        "name": "misp-galaxy:target-information=\"India\"",
        "relationship_type": ""
      },
      {
        "colour": "#e4d611",
        "local": false,
        "name": "misp-galaxy:target-information=\"Ukraine\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"APT28\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"russia\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#1c006d",
        "local": false,
        "name": "rectifyq:topic=\"geopolitical\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"APT\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773889231",
        "to_ids": false,
        "type": "link",
        "uuid": "5515a34a-d0ae-47a5-9926-4e3402b10c97",
        "value": "https://hunt.io/blog/operation-roundish-apt28-roundcube-exploitation"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773889231",
        "to_ids": false,
        "type": "text",
        "uuid": "83354e49-9a27-4232-916b-5d73b7d61698",
        "value": "An exposed open directory revealed a comprehensive Roundcube exploitation toolkit used by APT28 to target Ukrainian government entities. The toolkit includes XSS payloads, a Flask-based C2 server, CSS injection tools, and a Go-based implant. It enables credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and 2FA secret extraction. The primary target was identified as mail.dmsu.gov.ua, Ukraine's State Migration Service. Technical analysis shows significant overlaps with previously documented APT28 operations, while introducing new capabilities such as CSS-based side-channel attacks and browser credential theft. The toolkit's modular approach and sophisticated evasion techniques demonstrate APT28's evolving tactics in compromising webmail platforms for long-term intelligence gathering."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773889231",
        "to_ids": false,
        "type": "text",
        "uuid": "35e72fe0-3483-4b9a-bf76-1c9495c8afc0",
        "value": "Name: Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine\nAuthor: AlienVault\nAdversary: APT28\nTags: [\"css injection\", \"httd\", \"go implant\", \"fancy bear\", \"government\", \"credential theft\", \"ukraine\", \"webmail\", \"xss\", \"apt28\", \"spypress.roundish\", \"roundcube\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\", \"Ukraine\"]\nMlwr families: [\"SpyPress.Roundish\", \"httd\"]\nAttack_ids: [\"T1613\", \"T1059.007\", \"T1036.005\", \"T1053.003\", \"T1566.002\", \"T1021.004\", \"T1190\", \"T1567\", \"T1583.001\", \"T1087.003\", \"T1555.003\", \"T1595\", \"T1056.003\", \"T1114.003\", \"T1059.001\", \"T1562.001\", \"T1027\", \"T1114.002\", \"T1111\", \"T1543.002\"]\nIndustries: [\"Government\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773889231",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "924681dc-c8c1-4da6-b8f1-36fd12264778",
        "value": "APT28"
      },
      {
        "category": "Network activity",
        "comment": "C2 hosting IP",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229313",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9fef672b-9c98-413b-9b79-90ffb6898726",
        "value": "203.161.50.145",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:03/04/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775227054",
        "to_ids": true,
        "type": "sha1",
        "uuid": "45c187dc-0dbd-4da0-9d24-5962d0ed4c05",
        "value": "dc2983fbc868097c78f5bccea43eb5ac4b81aaf6",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ACT Fibernet India (exfiltrated config)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229334",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "2c48cd97-bbe1-411a-ba98-f12de08d1e24",
        "value": "106.51.89.49",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "SSH lateral movement target",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229356",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "aabb18fb-5609-4da0-a16e-1cde974cc52a",
        "value": "217.146.67.241",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229377",
        "to_ids": true,
        "type": "url",
        "uuid": "a4322069-0aa0-426c-a23e-60f525a7875f",
        "value": "http://zhblz.com/zJ2w9x",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Primary C2 server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229398",
        "to_ids": true,
        "type": "domain",
        "uuid": "2c205026-09de-4d92-ba79-b7bde442c0ab",
        "value": "zhblz.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "CSS injection server",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229419",
        "to_ids": true,
        "type": "hostname",
        "uuid": "de27f5d8-f4b5-431e-aa09-dac70317f938",
        "value": "a.zhblz.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Compromised victim",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229441",
        "to_ids": true,
        "type": "hostname",
        "uuid": "35bc7c1a-a102-40b8-8cd6-288568418ef0",
        "value": "blog.pentagonteam.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229462",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5de7903d-ad52-4d3e-b45e-4252d277012c",
        "value": "docs.goog1e.com.spreadsheets.d.1ipevana4hglaeksstshboujdk.zhblz.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Oracle Cloud pivot host",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229483",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9fcc4fe3-b2da-41bd-a82c-591f03aade35",
        "value": "130.61.233.105",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Persistent mail forwarding dead drop",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1774778780",
        "to_ids": true,
        "type": "email-src",
        "uuid": "868d6a3d-d89f-42df-83f5-a6bd2243a1b4",
        "value": "advenwolf@proton.me"
      },
      {
        "category": "Network activity",
        "comment": "Ukraine State Migration Service",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775229505",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c0b9d293-c3e4-424c-ade8-23de74ce53cf",
        "value": "mail.dmsu.gov.ua",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1775229528",
        "uuid": "24ff53b5-c8d0-463b-aa81-41c86e35263c",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1775229528",
            "to_ids": true,
            "type": "md5",
            "uuid": "4bd8b80d-e392-44cf-9049-0a1621df7843",
            "value": "4b3e139c122df9fbc08442b7823ebde9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1775227053",
            "to_ids": true,
            "type": "sha1",
            "uuid": "10b78e88-c181-4e41-a360-1b8a16b8b472",
            "value": "743f7ad2d7802a1f951899d6175df69622e51846",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1775227053",
            "to_ids": true,
            "type": "sha256",
            "uuid": "fbcac200-e586-41b2-b65f-1eed83cec16b",
            "value": "e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1775226119",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1fe7e7bc-e4ea-4b78-ab41-4a66eee7bc36",
            "value": "49152:6Af+Z7lUfrb/T4vO90dL3BmAFd4A64nsfJcQrXFdmS7KMQqangxlE9/XjIYUAbc8:3JPzGnUSfTj6EBc+"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1775226119",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0158d5d2-708a-4bee-b6ec-a5c7d1b68247",
            "value": "5435392"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1775226119",
            "to_ids": true,
            "type": "vhash",
            "uuid": "de4556d1-1850-47fd-ab3d-e4dd5b3c3847",
            "value": "83b7e04a4a6d626d7dd712758613d1d5"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1775226119",
            "to_ids": true,
            "type": "filename",
            "uuid": "8fe7ca35-a32b-4587-accc-1182796e19c6",
            "value": "proc"
          },
          {
            "category": "Other",
            "comment": "Checked: 03/04/2026\nLast-scan\t:  24/03/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1775226119",
            "to_ids": false,
            "type": "text",
            "uuid": "bfdb4680-ba8a-4495-a7b2-a683a6c9f77a",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Kaiji.C!MTB\nVT Total Detection:21/65\nFirst Submission:2025-11-13T18:40:26.000000+00:00\nLast Submission:2025-12-28T13:46:40.000000+00:00"
          }
        ]
      }
    ]
  }
}