July 7, 2026: Hackers did not need a malware attachment or a stolen password. They needed a professor to open an email. A China-aligned cluster chained two Roundcube flaws to take over university webmail servers, plant backdoors, and spy on academic researchers in physics and engineering departments across the United States and Canada, according to Proofpoint.
What happened
Proofpoint tracks the activity as UNK_MassTraction. Researchers first saw it in May 2026 and believe it was still running when CyberScoop and The Hacker News covered it in early July.
The kill chain is unusual. Most espionage campaigns use email to phish a human or drop malware on a laptop. Here, email was the delivery mechanism for an exploit chain against the mail server itself—Roundcube, the open-source webmail software many universities self-host.
The two-CVE chain
Attackers chained:
- CVE-2024-42009 — cross-site scripting triggered when a victim opens a crafted message; JavaScript runs in the browser session.
- CVE-2025-49113 — server-side flaw that gives a foothold on the Roundcube host after the first stage.
Proofpoint said generic lures were enough—no highly tailored thesis-topic bait required at the initial stage. After access, operators deployed webshells, backdoors including VShell, and infrastructure seen in other China-aligned espionage.
Who was in the crosshairs
Victims were not random students. Proofpoint pointed to physics and engineering departments—administrators and professors tied to astrophysics, particle physics, and work with national-security relevance. Proofpoint confirmed fewer than 10 universities but estimated a few dozen may ultimately be affected.
"There is a high likelihood that many victims have not been made aware of this activity yet," principal threat researcher Greg Lesnewich told CyberScoop. That gap matters: compromised webmail can keep reading traffic long after the first exploit.
Why this is not a normal breach notice
Roundcube is software, not a retailer with a single customer database. BreachHistory indexes this as a verified exploitation campaign against Roundcube deployments at academic institutions—not one company row with a neat victim count. Individual universities may publish their own notices later; until then, treat this as an active patch-and-hunt problem for any campus running Roundcube webmail.
What universities should do now
- Patch both CVEs on every Roundcube instance—assume unpatched servers in research faculties are high priority.
- Hunt for webshells and VShell on mail hosts; reimage if integrity is uncertain.
- Force password resets for accounts on affected hosts and review OAuth/IMAP forwarding rules attackers may have added.
- Brief researchers that opened-mailbox compromise can exfiltrate grant, collaboration, and export-control-sensitive threads without a second click.
Canonical record
BreachHistory campaign entry: Roundcube university espionage campaign (2026).
Sources: Proofpoint, CyberScoop, The Hacker News.