A suspected China-aligned threat cluster has been exploiting vulnerable Roundcube mail servers at universities in the US and Canada to steal credentials and establish network access. New research from Proofpoint, published on June 7, tracked the activity under the name UNK_MassTraction and found that attackers were targeting physics and engineering departments at academic institutions with potential links to national security. Proofpoint assessed that the attackers likely selected these organizations after identifying vulnerable Roundcube instances. The campaign used multiple known Roundcube vulnerabilities to compromise mail servers, using stolen credentials and server access as a pathway into victim networks rather than focusing solely on email data theft. The activity follows previous…