Chinese Cyberespionage Exploits University Roundcube Servers

The nation-state actor UNK_MassTraction is targeting university departments via Roundcube mailserver vulnerabilities to deploy malware and steal credentials. By chaining CVE-2024-42009 and CVE-2025-49113, the attackers gain unauthorized access and persistence within targeted networks.