Roundcube is a technology platform tracked by ThreatCluster, appearing in 6 threat clusters built from 12 intelligence report mentions.
Roundcube is a technology platform tracked across 6 threat clusters and 12 intelligence report mentions on ThreatCluster. First observed December 19, 2025; most recent activity July 24, 2026.
Russian threat actors TA488 and TA458 are exploiting vulnerabilities in webmail servers, specifically targeting Ukrainian entities and government sectors. TA488 utilizes a half-click exploit via CVE-2025-66376 in Zimbra…
A suspected China-aligned threat group, tracked as UNK_MassTraction, has been exploiting vulnerabilities in Roundcube mail servers at U.S. and Canadian universities since May 2026. The campaign targets physics and…
APT28 (Fancy Bear) has been linked to Operation Roundish, utilizing a comprehensive Roundcube exploitation toolkit against Ukrainian government targets. The toolkit, discovered in January 2026, includes XSS payloads, a…
On March 10, 2026, three critical vulnerabilities were published affecting Substance3D software. CVE-2026-21365 and CVE-2026-27219 both impact Substance3D - Painter versions 11.1.2 and earlier, exposing users to…
Roundcube Webmail has issued critical security updates for vulnerabilities in versions 1.6 and 1.5 LTS. These flaws, including a Cross-Site Scripting (XSS) issue in SVG handling, could allow attackers to execute…
A critical Cross-Site Scripting (XSS) vulnerability has been identified in Roundcube Webmail, enabling attackers to track email opens by loading remote images. This flaw affects users who have set their preferences to…
Roundcube is a technology platform tracked by ThreatCluster, appearing in 6 threat clusters built from 12 intelligence report mentions.
The most recent intelligence report mentioning Roundcube on ThreatCluster is dated July 24, 2026. Activity was first observed December 19, 2025, giving a tracked span from then to July 24, 2026.
Across ThreatCluster reporting, Roundcube most frequently co-occurs with Apt28, Fancy Bear, Forest Blizzard, FROZENLAKE, GreenCube, among 12 tracked related entities.
The most significant recent cluster is “Russian TA488 and TA458 Exploit Webmail Vulnerabilities in Espionage Campaigns” (2 articles · Updated July 23, 2026). Roundcube appears across 6 threat clusters in total, listed above with sources.
Roundcube appears in 12 intelligence report mentions across 6 deduplicated threat clusters, aggregated from 17,000+ monitored sources.