Inside the Arsenal: Exposed Server Reveals APT28’s ‘Roundish’ Toolkit and Advanced Cyber Espionage Tactics

### Executive Summary Hunt Intelligence uncovered an exposed open directory containing the "Roundish" espionage toolkit linked to APT28, revealing development and operational artifacts including Flask-based C2, a 5.2 MB Go implant ('httd') for persistence, CSS side-channel and browser credential-stealing techniques, and evidence of active reconnaissance and exfiltration targeting the Ukrainian State Migration Service.