BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities

**Recorded Future (Insikt Group) and CERT-UA report that the BlueDelta threat cluster (linked to APT28/GRU) ran a targeted spearphishing campaign against Ukrainian government entities, exploiting Roundcube vulnerabilities (CVE-2020-35730, CVE-2021-44026, CVE-2020-12641) and overlapping with prior Outlook exploitation (CVE-2023-23397) to execute JavaScript payloads that install forwarding rules, exfiltrate session cookies, address books, and Roundcube database information; the report includes infrastructure pivots, domains/IP IoCs, ATT&CK mappings, and mitigation guidance.**