CHINA-LINKED HACKERS EXPLOIT ROUNDCUBE FLAW AT US, CANADIAN UNIVERSITIES

The attackers targeted Roundcube webmail installations, gaining access to researcher accounts and institutional systems. The campaign focused on harvesting login credentials and establishing persistent backdoor access for continued surveillance. Roundcube, an open-source webmail client widely deployed in academic and enterprise environments, contained vulnerabilities that allowed the threat actors to compromise unpatched servers. The breach affects multiple universities across North America. Security researchers identified the activity through infrastructure analysis and malware samples. The threat cluster's focus on academic institutions suggests targeting sensitive research data and intellectual property. Affected organizations have been notified to patch Roundcube installations immediately and audit compromised accounts for unauthorized access. The incident underscores ongoing targeting of educational institutions by state-sponsored groups seeking research and development information.