Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities | CyberScoop<\/title> <meta name=\"description\" content=\"Proofpoint researchers said attackers targeted physics and engineering departments, and warn that the campaign is likely ongoing.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/china-espionage-attacks-us-canada-universities-proofpoint\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities\"> <meta property=\"og:description\" content=\"Proofpoint researchers said attackers targeted physics and engineering departments, and warn that the campaign is likely ongoing.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/china-espionage-attacks-us-canada-universities-proofpoint\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-07-07T09:00:00+00:00\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1778775768g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1783350695g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1782867887g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9519dd464d894b805a10\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/89723\"><meta name=\"generator\" content=\"WordPress 6.8.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=89723\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-espionage-attacks-us-canada-universities-proofpoint%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-espionage-attacks-us-canada-universities-proofpoint%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-89723 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/china-espionage-attacks-us-canada-universities-proofpoint\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.861826697892\">\n<div class=\"single-article__header-content\" readability=\"35.383495145631\">\n<p> Proofpoint researchers said attackers targeted physics and engineering departments, and warn that the campaign is likely ongoing. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/89723\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"486\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities.jpg?resize=640%2C486&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg 1987w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=300,228 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=768,583 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=1024,777 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=1536,1166 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=600,455 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=221,168 221w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=444,337 444w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=889,675 889w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-2.jpg?resize=1111,843 1111w\" sizes=\"(max-width: 889px) 100vw, 889px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"32.698810269255\"><body readability=\"67.665792431622\"><\/p>\n<p>China-aligned attackers broke into the networks of <a href=\"https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/one-email-closer-edge-unkmasstraction-physics-exploitation\">U.S. and Canadian universities<\/a> to steal sensitive data and establish persistent access via webshells and backdoors, Proofpoint threat researchers said Tuesday. <\/p>\n<p>The espionage-motivated attacks targeted physics and engineering departments, focusing on administrators and professors with national security links or organizations researching astrophysics and particle physics.<\/p>\n<p>Proofpoint identified less than 10 university victims and estimates a few dozen universities may be impacted, Greg Lesnewich, principal threat researcher at Proofpoint, told CyberScoop. The company first observed the campaign in May and believes the campaign is ongoing. <\/p>\n<p>\u201cThere is a high likelihood that many victims have not been made aware of this activity yet,\u201d Lesnewich added.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Researchers traced the attacks to a pair of critical vulnerabilities in Roundcube, an open-source email client, that were exploited and chained together to steal credentials and gain long-term access.<\/p>\n<p>The threat cluster, which Proofpoint tracks as UNK_MassTraction, exploited <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2024-42009\">CVE-2024-42009<\/a> to execute JavaScript inside the victim\u2019s browser, then exploited <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2025-49113\">CVE-2025-49113<\/a> to gain a foothold in the mailserver. <\/p>\n<p>The initial exploit in the chain only requires a victim to open an email, and the attackers sent victims a series of generic lures to trigger the initial access.<\/p>\n<p>Proofpoint attributes the campaign to a China-aligned cluster because the attackers used a known covert network used by multiple China-aligned threat groups, an infection chain leading to VShell and left Chinese language artifacts in the phishing emails. <\/p>\n<p>Researchers haven\u2019t drawn any conclusions about why attackers targeted the universities and what they are seeking. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cWe do not have data to suggest what got stolen, as we only observe the initial inbound email attempt,\u201d Lesnewich said. <\/p>\n<p>The engineering aspects do align with China\u2019s strategic initiatives, he added. Google threat hunters recently spotted a Chinese state-sponsored espionage group that <a href=\"https:\/\/cyberscoop.com\/google-unc6508-china-espionage-threat\/\">burrowed into systems for years<\/a>, stealing data across academia, medicine, military, cybersecurity and foreign policy. <\/p>\n<p>\u201cChina-aligned adversaries have been targeting other types of edge devices such as routers and VPN concentrators for years with various exploits to create a foothold into a target network, not using email for delivery,\u201d Lesnewich said. \u201cThis campaign flips that on its head, using email to deliver an exploit chain to compromise a mail server, instead of using email to deliver a credential harvesting URL or malware to target an end user, not a server.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.4608778625954\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/china-espionage-attacks-us-canada-universities-proofpoint\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Suspected Chinese espionage group used a Roundcube exploit chain to<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4449,271,78,2925,624,2659,60,7021,4274,256,7022,288,7023,643,2281],"tags":[4452,277,86,2926,629,2661,67,7024,4277,262,7025,294,7026,645,2283],"class_list":["post-8803","post","type-post","status-publish","format-standard","hentry","category-academia","category-china","category-cybersecurity","category-email","category-espionage","category-exploit","category-phishing","category-phishing-email","category-proofpoint","category-research","category-roundcube","category-threats","category-university","category-vulnerabilities","category-vulnerability","tag-academia","tag-china","tag-cybersecurity","tag-email","tag-espionage","tag-exploit","tag-phishing","tag-phishing-email","tag-proofpoint","tag-research","tag-roundcube","tag-threats","tag-university","tag-vulnerabilities","tag-vulnerability"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/academia\/\" rel=\"category tag\">academia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/china\/\" rel=\"category tag\">China<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/email\/\" rel=\"category tag\">email<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/espionage\/\" rel=\"category tag\">espionage<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/exploit\/\" rel=\"category tag\">exploit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/phishing\/\" rel=\"category tag\">phishing<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/phishing-email\/\" rel=\"category tag\">phishing email<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/proofpoint\/\" rel=\"category tag\">Proofpoint<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/roundcube\/\" rel=\"category tag\">Roundcube<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/university\/\" rel=\"category tag\">university<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vulnerabilities\/\" rel=\"category tag\">vulnerabilities<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vulnerability\/\" rel=\"category tag\">vulnerability<\/a>","tag_info":"vulnerability","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8803"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8803\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8803"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8803,"date":"2026-07-07T04:00:00","date_gmt":"2026-07-07T09:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=89723"},"modified":"2026-07-07T04:00:00","modified_gmt":"2026-07-07T09:00:00","slug":"suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/07\/07\/suspected-chinese-espionage-group-used-a-roundcube-exploit-chain-to-burrow-into-universities\/","title":{"rendered":"Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities"},"content":{"rendered":"