2026 Roundcube — CVE chain exploited against U.S./Canadian university webmail; academic espionage campaign
Data compromised
Proofpoint observed credential theft and persistent access on university Roundcube instances targeting administrators and professors in astrophysics and particle physics; fewer than 10 confirmed victims with estimates of a few dozen universities potentially affected—specific exfiltrated datasets not publicly attested
Technical writeup
Verified threat-intelligence campaign — reported July 7, 2026. Proofpoint documented China-aligned cluster UNK_MassTraction exploiting two Roundcube vulnerabilities in sequence: CVE-2024-42009 (cross-site scripting via crafted email, victim need only open message) followed by CVE-2025-49113 (server-side foothold). Targets were U.S. and Canadian universities—especially physics and engineering departments and researchers tied to astrophysics, particle physics, and national-security-adjacent work. Proofpoint confirmed fewer than 10 victims but estimated a few dozen institutions may be affected; many may not yet know. Attackers deployed webshells, backdoors including VShell, and used infrastructure associated with China-aligned espionage. This BreachHistory row documents the Roundcube software exploitation wave affecting academic tenants—not a single vendor corporate DB leak—so recordsAffected remains 0 pending per-university victim counts.
Root cause
China-aligned threat cluster UNK_MassTraction chained CVE-2024-42009 and CVE-2025-49113 against Roundcube servers at physics/engineering departments—initial access via opened email, then mailserver foothold, webshells, and backdoors per Proofpoint