APT28 Reuses Old Access and Roundcube Exploits Against Ukrainian Institutions

Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including APT28 and Void Blizzard, with the security and defense sector remaining the top target because disruptions there could affect the war effort.

Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to APT28 (Fancy Bear, BlueDelta, Forest Blizzard), that targeted prosecutors, anti-corruption bodies, and other local government entities through Roundcube webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.