A China-linked threat cluster is exploiting vulnerable Roundcube servers at academic institutions in the U.S. and Canada to steal credentials and deploy backdoor malware.
The attackers targeted Roundcube webmail installations, gaining access to researcher accounts and institutional systems. The campaign focused on harvesting login credentials and establishing persistent backdoor access for continued surveillance.
Roundcube, an open-source webmail client widely deployed in academic and enterprise environments, contained vulnerabilities that allowed the threat actors to compromise unpatched servers. The breach affects multiple universities across North America.
Security researchers identified the activity through infrastructure analysis and malware samples. The threat cluster's focus on academic institutions suggests targeting sensitive research data and intellectual property.
Affected organizations have been notified to patch Roundcube installations immediately and audit compromised accounts for unauthorized access. The incident underscores ongoing targeting of educational institutions by state-sponsored groups seeking research and development information.
Google is rolling out Encrypted Client Hello (ECH) support in Android 17 to prevent network monitoring of user browsing activity. The privacy feature strengthens connection security across cellular and home networks.
A new survey shows more Americans oppose police use of license plate readers than support them. The finding reflects growing concerns about surveillance overreach.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a "major incident" involving a compromised system following claims by the Qilin ransomware group.
Claude, Codex, and Hermes generated 227 install commands referencing code with no identifiable owners, according to analysis of corporate documentation. The discovery raises security concerns about AI-generated dependencies.