[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPuHADadcmnqqJCj-wAOa3CxC1vNA6ZKoSCCmdNF0e-w":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"7bd204fc-ba44-4c8c-b757-fda0638ab5c3","UNK_MassTraction Exploits Roundcube Flaws Against US, Canadian Universities","unk-masstraction-exploits-roundcube-flaws-against-us-canadian-universities-ddf91f","China-linked UNK_MassTraction targets US and Canadian universities through Roundcube flaws, stealing sessions and opening access to research mail servers.","A suspected China-aligned espionage group, UNK_MassTraction, is targeting US and Canadian universities by exploiting Roundcube vulnerabilities. The campaign, active since May 2026, focuses on physics and engineering departments with sensitive research, aiming to steal session data and gain access to research mail servers.","China-linked UNK_MassTraction targets US\u002FCanadian universities via Roundcube flaws.","https:\u002F\u002Fhackread.com\u002Funk-masstraction-roundcube-us-canada-universities\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Funk-masstraction-hackers-roundcube-us-canada-universities-1.png","2026-07-08T11:54:48+00:00","2026-07-08T12:00:34.822694+00:00",9,[17,20,23],{"name":18,"type":19},"UNK_MassTraction","threat_actor",{"name":21,"type":22},"Roundcube","product",{"name":24,"type":25},"PHP web shell","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":28,"name":29,"slug":30},null,"Nation-state","nation-state",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2024-42009","Cross-site scripting vulnerability in Roundcube exploited to trigger JavaScript.",{"type":51,"value":55,"context":56},"CVE-2025-49113","Deserialization vulnerability in Crypt_GPG component used for malware installation.",[21],{"controls":59,"vendors":146},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"patch-management","Automated patch management","Known holes get closed in days, not months.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":61,"product_name":85,"url":86,"description":87},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":118,"name":119,"problem":120,"products":121},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":169},"china-linked-group-exploits-unpatched-roundcube-to-target-university-research","China-Linked Group Exploits Unpatched Roundcube to Target University Research","UNK_MassTraction is actively exploiting known vulnerabilities in Roundcube webmail to compromise university mail servers at US and Canadian institutions, with a focused interest in physics and engineering research data. The root cause is a failure to promptly patch internet-facing webmail infrastructure, leaving well-documented vulnerabilities open to exploitation by sophisticated threat actors. Universities often struggle with decentralized IT governance and under-resourced security teams, making timely patching of critical systems inconsistent. The theft of session data provides attackers persistent, credential-free access to sensitive research communications, which is particularly damaging given the national security implications of academic research in sensitive scientific fields. This campaign underscores that academic institutions are high-value espionage targets and must treat their research infrastructure with the same security rigor as government or defense organizations.",[158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-12: Session Termination","NIST SP 800-53 IA-2: Multi-Factor Authentication","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.IP-12: Vulnerability Management Plan","CISA KEV (Known Exploited Vulnerabilities) Catalog","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","ITIL Change Management: Emergency Change Procedures",{}]