Cybersecurity incident — 2023-06-20 00:00:00
Affected organization: Undisclosed Ukrainian government entities
Affected country: Ukraine
Industry: Public Administration
Event type: Exploitive
Event subtype: Exploitation of End Host
Motive: Political-Espionage
Actor: GRU 85th Main Special Service Center (Unit 26165) (FANCYBEAR)
Actor type: Nation-State
Actor country: Russian Federation

A joint investigation conducted by Ukraine's Computer Emergency Response Team (CERT-UA) and Recorded Future reveal that the APT28 group, linked to Russia's General Staff Main Intelligence Directorate (GRU), has breached Roundcube email servers belonging to multiple Ukrainian organizations, including government entities, exploiting the vulnerabilities CVE-2020-35730, CVE-2020-12641, and CVE-2021-44026.