Loading malware…
Roundish is a modular webmail exploitation toolkit and JavaScript implant set associated with APT28, the Russia-linked espionage group also tracked as Fancy Bear and Sednit. It is designed primarily to compromise Roundcube webmail accounts used by government and defense targets, with observed targeting aligned to Ukrainian government entities and defense-related organizations in Eastern Europe. The toolkit has been linked to broader APT28 webmail espionage activity through distinctive tradecraft overlaps with Operation RoundPress.
Roundish centers on stored or reflected webmail exploitation that enables malicious JavaScript execution in a victim’s browser. Its capabilities include credential theft through hidden form-field injection and browser autofill capture, theft of session-relevant data, bulk email exfiltration through Roundcube functionality, address book theft, extraction of TOTP secrets for multi-factor authentication bypass, and establishment of persistent access by creating server-side mail-forwarding rules. The toolkit also includes a CSS-based side-channel component for progressive extraction of sensitive DOM values such as anti-CSRF tokens, extending collection options even where direct JavaScript execution is constrained.
The toolkit is notable for combining client-side webmail compromise with broader post-exploitation components. Recovered artifacts indicate supporting command-and-control infrastructure, phishing-style credential capture pages, and an additional GNU/Linux implant used for persistence on compromised servers. That Linux component reportedly supports persistence through cron, systemd, and security-policy manipulation, indicating that Roundish can extend from mailbox compromise into server-side footholds when exploitation paths permit.
Observed delivery and access patterns include spearphishing emails carrying malicious content that triggers Roundcube cross-site scripting exploitation when opened in the web interface. Associated activity has also involved exploitation of multiple Roundcube vulnerabilities, including XSS, SQL injection, and remote code execution flaws, to steal mailbox contents, dump backend data, and potentially obtain shell access. Overall, Roundish represents an espionage-focused toolkit for long-term access to webmail communications, credential material, and related organizational data.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Анатомия JavaScript implant: SpyPress и Roundish toolkit. По данным Hunt.io (Operation Roundish) и ESET (Operation RoundPress), JavaScript implant выполняет до шести операций за одну XSS-инъекцию.
In January 2026, we identified an exposed open directory ... that contained what appears to be a complete Roundcube exploitation toolkit... Roundish introduces additional components... including a CSS-based side-channel module and browser credential theft capabilities.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Toolkit/implant set used in APT28 webmail compromises, enabling credential harvesting, mail-forwarding persistence, email and address-book theft, 2FA extraction, and follow-on exploitation of compromised webmail environments.
A toolkit associated with Roundcube exploitation that supports credential harvesting, mail forwarding, bulk email exfiltration, address book theft, 2FA secret extraction, and browser credential theft.
A Roundcube-focused exploitation toolkit used to execute JavaScript XSS payloads for credential harvesting (including browser password-manager autofill abuse), bulk mailbox exfiltration via Roundcube APIs, address book theft, TOTP/2FA secret extraction, and creation of persistent server-side Sieve mail-forwarding rules to an operator-controlled mailbox. It also includes supporting C2/phishing infrastructure and a CSS selector side-channel module for token/DOM value extraction.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.