UNK_MassTraction Exploits Roundcube Flaws Against US, Canadian Universities

UNK_MassTraction is actively exploiting known vulnerabilities in Roundcube webmail to compromise university mail servers at US and Canadian institutions, with a focused interest in physics and engineering research data. The root cause is a failure to promptly patch internet-facing webmail infrastructure, leaving well-documented vulnerabilities open to exploitation by sophisticated threat actors. Universities often struggle with decentralized IT governance and under-resourced security teams, making timely patching of critical systems inconsistent. The theft of session data provides attackers persistent, credential-free access to sensitive research communications, which is particularly damaging given the national security implications of academic research in sensitive scientific fields. This campaign underscores that academic institutions are high-value espionage targets and must treat their research infrastructure with the same security rigor as government or defense organizations.