Roundish
Roundish is a Roundcube-focused exploitation toolkit and malware framework assessed with medium-high confidence to align with APT28 (Fancy Bear/Sednit), the Russian GRU-linked threat actor. Researchers identified an exposed open directory on 203.161.50[.]145:8889 in January 2026 containing a reportedly complete toolkit, including development and production XSS payloads, a Flask-based C2 server, CSS-injection tooling, operator bash history, and a Go-based Linux implant. The toolkit targets webmail, especially Roundcube, to harvest credentials, exfiltrate emails in bulk via the Roundcube viewsource API, steal address book contents, extract 2FA/TOTP secrets, and establish persistence through server-side Sieve mail-forwarding rules that redirect mail to advenwolf@proton[.]me. Roundish uses modular eval()-based JavaScript loading and base64-encoded exfiltration. Distinctive capabilities include an uncommon XSS technique that injects hidden username/password fields to capture browser password-manager autofill values, a CSS selector side-channel module (roundcube-css-exploit.js) for progressive extraction of DOM values such as CSRF tokens without JavaScript injection, and browser credential theft targeting Chrome and Firefox. Operator artifacts and infrastructure analysis confirmed active targeting of mail.dmsu.gov.ua, the Roundcube instance of Ukraine’s State Migration Service. Related infrastructure included a C2 server at 203.161.50[.]145 hosted on Namecheap infrastructure in Phoenix, Arizona; a primary C2 domain zhblz[.]com and subdomain a.zhblz[.]com used for the CSS side-channel server; and an Oracle Cloud pivot host at 130.61.233[.]105 in Frankfurt used for SSH pivoting. The exposed server also hosted a Flask C2 component (serverlast.py) that served a cloned Roundcube login page and captured credentials via /authentification.php before redirecting victims to a lure PDF named Adob_Scan_15_ian._2025.pdf. A Go-based Linux implant named httd (SHA-256: e76f54b7b98ba3a08f39392e6886a9cb3e97d57b8a076e6b948968d0be392ed8) was also found in exfiltrated data and provided persistence via cron, systemd, and SELinux policy manipulation.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Roundish introduces additional components not previously documented in APT28 webmail activity, including a CSS-based side-channel module and browser credential theft capabilities.
In January 2026, we identified an exposed open directory ... that contained what appears to be a complete Roundcube exploitation toolkit... Roundish introduces additional components... including a CSS-based side-channel module and browser credential theft capabilities.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Credential Access
2 techniques
Credential Access
Discovery
1 technique
Discovery
Collection
2 techniques
Collection
IOCs tracked for this family
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A toolkit associated with Roundcube exploitation that supports credential harvesting, mail forwarding, bulk email exfiltration, address book theft, 2FA secret extraction, and browser credential theft.
A Roundcube-focused exploitation toolkit used to execute JavaScript XSS payloads for credential harvesting (including browser password-manager autofill abuse), bulk mailbox exfiltration via Roundcube APIs, address book theft, TOTP/2FA secret extraction, and creation of persistent server-side Sieve mail-forwarding rules to an operator-controlled mailbox. It also includes supporting C2/phishing infrastructure and a CSS selector side-channel module for token/DOM value extraction.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.