Threat Actors Aligned with China Attacking U.S. University Physics + Engineering Depts.

Short summary

Chinese threat actors (UNK_MassTraction) are exploiting n-day Roundcube vulnerabilities in academic mailservers to target U.S. and Canadian university physics, engineering, and particle physics departments—specifically researchers with national security ties. The campaign uses deceptive emails that trigger automatic exploits on open, stealing credentials and installing VShell backdoors. Universities should defend mailservers as rigorously as VPN infrastructure and train all faculty and administrators in targeted security awareness.

• •UNK_MassTraction targeting physics, engineering, and astrophysics departments at U.S./Canadian universities since May 2026
• •Exploiting Roundcube n-day XSS vulnerabilities—emails auto-exploit on open without user interaction required
• •Defenders should prioritize mailserver defense with strong cybersecurity and targeted admin/faculty security training

Generated with AI, which can make mistakes.