APT28 Exploits Roundcube for Ukraine Cyber Espionage

The Record by Recorded Future reports that Ukraine has confirmed a campaign by the threat actor APT28 targeting its prosecutors and anti-corruption agencies. This operation leveraged vulnerabilities within the open-source Roundcube webmail platform. The attack vector is particularly insidious, requiring only that a victim opens an email in their inbox to trigger malicious code execution.

This campaign underscores a persistent threat to government and sensitive sectors. By targeting email infrastructure, APT28 gains a direct pathway into an organization’s internal communications and sensitive data. The use of a widely deployed open-source product like Roundcube suggests a broad potential attack surface, not just for Ukraine but for any organization relying on it.