In a campaign reported in June 2023, researchers linked Ukraine-themed spear-phishing to exploitation of vulnerable Roundcube webmail servers used by Ukrainian organizations. Recorded Future’s Insikt Group called the activity BlueDelta; Recorded Future and CERT-UA associated it with APT28, which reporting links to Russia’s GRU. The emails were the lure—the Roundcube flaws were the technical weakness. A recipient did not need to open the attachment for the reported exploit to affect a vulnerable server.
What happened in the Roundcube campaign?
SecurityWeek reported on June 20, 2023, that a Russian government-linked group had targeted Ukrainian organizations, including government institutions and military entities involved in aircraft infrastructure. Recorded Future said it had observed suspicious communications involving Ukrainian entities dating from March 2023 and analyzed a spear-phishing sample with CERT-UA. Its reporting described an espionage operation, not a consumer account takeover campaign: compromised webmail servers were used for reconnaissance and collection of email-related information.
The attribution is an intelligence assessment, not a publicly established identity for every operator or intrusion. Recorded Future and CERT-UA associated the activity with BlueDelta/APT28, and reporting connected APT28 to Russia’s GRU. SecurityWeek’s incident report summarizes the attribution and reported activity; Recorded Future’s BlueDelta analysis provides its technical account.
How did the phishing attack work?
The email used news themes related to Russia’s war against Ukraine to make its content appear timely and encourage recipients to open it in Roundcube. The attached JavaScript file was part of the lure, but the critical distinction is that the reported compromise did not depend on executing that attachment: the email was opened in a vulnerable Roundcube webmail interface, where malicious content could exploit the server-side webmail software.
#1 Best Overall
![M6 Cage Nuts, Screws and Washers [Size: M6 x 16mm 50 Pack] Rack Mount Screws Hardware for use with Network and Server Rack Accessories, Routers, Cabinets and Enclosures.](https://m.media-amazon.com/images/I/51yizSYkrhL._SL160_.jpg)
- Pro Grade – Here is our new Black M6 Rack Screws and Cage Nuts Set [25 x Server Rack Screws, 25 x Cage Rack Nuts, 25 x Washers] used for mounting server racks, enclosures, cabinets, and more.
- Strong & Durable – Our Rack Cage Nuts & Relay Rack Screws for server rack have a high-grade carbon steel construction to prevent stripping. The M6 Cage Nuts and Bolts have also been coated in zinc chromate plating for resistance from corrosion.
- Wide application – Our rack screws & nuts are universally compatible with all square hole racks & cabinets. This makes the rack cage nuts and screws suitable for mounting all server rack hardware, including rack server cabinets, server shelves, A/V device enclosures, and other server mounting procedures.
- Easy to install – Our server rack screws and clip nuts have a Phillip’s truss-head with self-guiding pilot points to allow you to install in no time. The rackmount screws and nuts thread are extra sharp, clean & accurate, offering a smooth & satisfying installation process.
- Essential Bundle – Our Cage nuts & screws m6 set includes all the essential parts for mounting your server equipment. Pack not only includes screws & cage nuts; we have also thrown in additional heavy-duty washers to reduce any marks or scratches when installed. We truly believe our server rack nuts and bolts set is the best in the marketplace and we stand by that. If our cage nut set starts driving you nuts, we’ll FULLY REFUND YOU. So, click “Add to Cart” now and buy with confidence.
- Delivery: A spear-phishing email with Ukraine-related news themes reached a target.
- Exposure: The recipient viewed the message in a Roundcube instance affected by a relevant vulnerability.
- Exploitation and follow-on code: The reviewed sample was designed to exploit CVE-2020-35730. After exploitation, JavaScript fetched and executed two additional JavaScript payloads from a remote server. Recorded Future also identified a third malicious JavaScript file associated with the infrastructure.
- Espionage collection: Reporting described reconnaissance and collection from compromised servers, including redirecting incoming mail and gathering session cookies, user information, and address books.
This chain explains why “the user opened an attachment” is an incomplete description of the risk. The lure sought attention, while the vulnerable Roundcube instance provided the exploit path. This account describes the sample and activity reported by Recorded Future; it does not establish that every target received identical payloads or that every named vulnerability was used in every intrusion.
Which Roundcube vulnerabilities were named?
CERT-UA#6805 and related reporting named three CVEs in connection with the campaign. The identifiers should be read as vulnerabilities reported in the campaign, not a claim that all three were necessarily chained in every observed compromise.
Rank #2
- Durable Carbon Steel: Rack mount screws and cage nuts are made of high-quality carbon steel with a black finish for high strength and dependable durability.
- Easy Installation: Clear metric threads and uniform pitch for better grip. Nylon washers help secure screws and protect equipment surfaces.
- Organized Storage: All parts are packed in a portable storage box for easy organization and access.
- Wide Compatibility: Fits most square-hole racks and cabinets—ideal for server racks, network cabinets, equipment enclosures, and A/V gear.
- 20-Set Kit: Includes 20 mounting screws with nylon washers (M6 x 20 mm) and 20 square cage nuts—40 pieces in total—meeting daily install and replacement needs.
| CVE | Issue described in the 2023 advisory | Historical affected versions listed by WA Cyber Security Unit |
|---|---|---|
| CVE-2020-35730 | Cross-site scripting (XSS) | Before 1.2.13; 1.3.x before 1.3.16; and 1.4.x before 1.4.10 |
| CVE-2020-12641 | Remote code execution | Before 1.4.4 |
| CVE-2021-44026 | SQL injection | Before 1.3.17 and 1.4.x before 1.4.12 |
The version cutoffs above come from the Western Australia Cyber Security Unit’s June 23, 2023 advisory and are historical ranges for those flaws—not today’s safe-version boundary. The WA Cyber Security Unit advisory provides the listed ranges and response guidance. NIST’s CVE-2020-35730 entry describes that vulnerability and its affected-version details. Administrators should use current vendor release guidance and any applicable operating-system or distribution advisories, rather than treating a 2023 threshold as a current upgrade target.
What should Roundcube administrators do?
Patch first, then determine whether an exposed instance may have been vulnerable during the relevant period. Because the reported activity involved exploitation of the webmail server, investigation should cover server and mail behavior as well as whether users interacted with suspicious messages.
Rank #3
- 10-32 Rack Screws provide outstanding stability and sturdy support for 2-post server racks and network cabinets. Made of high-grade carbon steel, this 50-pack features solid load-bearing capacity, not easy to slip or deform, keeping your rack devices firmly fixed without loosening after long-term use
- Rack Mount Screws are pre-fitted with premium nylon washers for accurate and smooth installation. The tight seamless fit avoids scratching equipment panels, effectively reduces shaking and vibration, locks devices securely and greatly improves overall installation safety
- Studio Rack Screws are ideal accessories for recording studios and audio professionals. With standard 10-32 universal thread, they perfectly fit all kinds of studio rackmount equipment, prevent position shifting and hardware failure, and ensure continuous and stable creative work
- Zinc Plated Rack Screws offer excellent anti-rust, anti-oxidation and corrosion protection. The premium galvanized surface resists moisture and daily wear, maintains high hardness and neat appearance, prolongs service life for server room, studio and indoor rack installation
- Universal Rack Screws fit multi-scenario mounting needs perfectly. Widely compatible with server cabinets, network enclosures, audio mounts, AV brackets and rackmount devices, suitable for home, office and professional engineering installation with strong versatility
- Update from authoritative guidance. Check the Roundcube security-news and release page for current releases and follow the update instructions for your installation. The project’s September 6, 2026 notice lists releases 1.6.19 and 1.7.4 and says they fix recently reported security vulnerabilities. Its May 24, 2026 notice recommends updating productive 1.6.x and 1.7.x installations, but the September notice is later; verify current vendor guidance before acting.
- Identify exposed and potentially vulnerable systems. Inventory internet-facing Roundcube servers, determine their installed versions and patch history, and check the relevant distribution advisory if the software is packaged and maintained by your operating-system vendor.
- Investigate possible compromise. If a server was vulnerable or exposure cannot be ruled out, conduct comprehensive analysis and threat hunting. Look for suspicious mail redirection, unexpected server-side activity, access to user information or address books, and unusual session-cookie collection or use. Preserve relevant logs and escalate through your incident-response process if indicators of compromise appear.
- Add layered email and network controls. Where feasible, disable HTML or JavaScript in email attachments; filter inbound mail and enforce sender-authentication controls such as SPF or DKIM; and use network detection or prevention for malicious domains and infrastructure. These measures reduce opportunities for related activity but do not replace patching or prove that a server is clean.
The 2023 advisory recommended faster response for internet-facing servers, applying vendor updates, and comprehensive analysis and threat hunting where vulnerable systems were found. See the advisory’s mitigation guidance alongside current vendor instructions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the reports do—and do not—establish
The available reporting describes a targeted espionage campaign and technical activity observed by researchers; it does not establish a reliable campaign-wide victim count or a total financial loss. Nor does the fact that three CVEs were named establish that each was used against every target. Treat the attribution and scope as reported intelligence findings, and base incident decisions on your own system exposure, logs, and threat-hunting results.
Quick Recap
Best Value
- 【Wide Application】 XOOL M6 Rack Mount Screw Kit is great for mounting your rack server cabinets, server shelves, A/V device enclosures, and more. These M6 cage nuts and screws are universally compatible with all square-hole racks and cabinets. Easily mount your equipment using this convenient kit, which comes with everything you'll need to get the job done. These self-locking cable ties are perfect for computer, appliance and electronic cord organization, wire management and storage.
- 【Superb Quality】 The cage nuts and screws is made of high quality Carbon Steel. The Carbon Steel material features strength and offers good corrosion resistance in bad environment like high temperature, cold weather, and high humidity areas. They have superior rust resistance and the excellent of oxidation resistance, which can ensure long time using and prolong screws and nuts lifespan. Wear resistant feature make the cage nuts and screws more durable and solid.
- 【Standard Metric】 Our M6 screws and cage nuts accord with standardized metric system. And the average error is less than 0.01mm. The screw thread is very sharp, clean and accurate without burr. The compact and force uniform screw thread is not easy to out of shape and slid in the process of rolling and installation. The deep and clear flat cross head can make your working more easily and improve your work efficiency.
- 【Safety and Eco-Friendly】 XOOL M6 screws and cage nuts use high quality Carbon Steel raw material, which is environmental protection and non-poisonous. In the process of using, there are no toxic substances releasing, which will ensure your safety. After heat treating, carbon steel has good mechanical properties of ductility, hardness, yield strength, or impact resistance.
- 【Thoughtful Design】 We add self-locking Nylon cable ties on our package. The CABLE TIES is good for home, office, garage, workshop and more. And the screw is very easy to insert with hand.
Rank #4
- 1. Tool-Free Installation: Replaces traditional screws with knurled thumb screws -install securely by hand without tools. Fix 19″ square‑hole cage nuts into racks, then twist screws directly in seconds,eliminating need for screwdrivers or drills.
- 2. Premium Carbon‑Steel Durability – Our Rack Screws(knurled thumb screws) made from heat-treated carbon steel (non-toxic, eco-safe) with high hardness, yield strength and impact resistance,and can support a wide range of server rack and A/V equipment securely. The perfect rack mount hardware solution that’s built to last.
- 3. Scratch-Proof Protection: Soft rubber washers protect your equipment's surface from scratches while enhancing fastening and vibration resistance—critical for sensitive server frames and A/V equipment, eliminating scratches during tightening.
- 4. Universal Compatibility: Works with all standard 19" server racks, A/V cabinets, and network enclosures. Ideal for rack servers, switches, and patch panels.
- 5. Complete Rack Mount Kit: Includes 19″ square-hole cage nuts 、tool‑free server rack screws and soft rubber washers combo, ensuring quick install rack hardware for 1U-4U devices.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
