APT28 Roundcube Webmail Exploitation: Suspicious Webshell/Script Drop

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•1

Detects the creation or modification of suspicious web-related script files (PHP, ASPX, JSP, SHTML) in common web server directories, excluding activities from legitimate web server processes. This rule aims to identify potential webshell deployment or other post-exploitation activities, specifically linked to APT28's targeting of Roundcube webmail servers.