# Suspected China‑Linked Hackers Hit U.S. and Canadian Universities in Roundcube Campaign

*Tuesday, July 7, 2026 at 10:08 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-07-07T10:08:47.908Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/10270.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A suspected China‑aligned group has exploited now‑patched Roundcube webmail flaws to infiltrate U.S. and Canadian university departments, stealing credentials, two‑factor data and cookies. The campaign shows how academic institutions have become soft targets in strategic cyber espionage battles, and unpacks how a single mail server compromise can fan out across research, policy and student data.

A newly detailed cyber‑espionage campaign targeting U.S. and Canadian universities is turning campus mail servers into an intelligence goldmine, underscoring how higher‑education networks have become a preferred soft target in state‑linked hacking.

Cybersecurity researchers have linked the activity to a suspected China‑aligned actor dubbed UNK_MassTraction, also referred to as IceCube in some technical write‑ups. The group is reported to have exploited vulnerabilities in Roundcube, a popular open‑source webmail client, to compromise email systems at multiple university departments in both countries. The attackers took advantage of now‑patched flaws, including CVE‑2025‑49113, to gain deep access to mail infrastructure.

According to the technical analysis, the operation unfolded in stages. First, the attackers leveraged Roundcube bugs to gain a foothold on targeted mail servers. From there, they harvested user credentials, two‑factor authentication data and browser cookies, giving them the keys to a wide range of accounts beyond webmail itself. They then used CVE‑2025‑49113 to deploy either VShell, a commercial secure shell server, or custom web shells, effectively securing long‑term, covert access for remote command and control.

For the universities involved, the immediate risk is that sensitive data have left their networks without triggering obvious alarms. Faculty and graduate students often sit at the intersection of government, industry and academia, working on topics from advanced materials and AI to policy analysis and regional security. Email accounts can expose draft research, intellectual property, grant proposals, personal data and candid conversations about government programmes or corporate partnerships.

Operationally, the campaign shows how exploiting a webmail platform can grant attackers much more than message content. Stolen cookies and multi‑factor tokens can be repurposed to breach single sign‑on systems, cloud storage, internal portals and even VPNs, allowing intruders to move laterally across an institution. For campus IT teams already strained by budget and staffing constraints, the challenge is not just patching software like Roundcube but mapping all the systems that trust those credentials.

Strategically, the reported Chinese nexus matters. Universities are valuable precisely because they sit outside the most locked‑down government networks while still touching sensitive research and policy communities. A China‑aligned group harvesting long‑term access to North American academic departments fits a wider pattern of espionage that aims to quietly track cutting‑edge science, monitor diaspora communities, and keep a finger on the pulse of Western policy thinking.

The campaign also illustrates a broader shift in cyber conflict: the front line is no longer limited to defence ministries and critical infrastructure operators. A vulnerable mail plugin at a university can become an entry point into the ecosystems that feed government and industry with people, ideas and technology. For students and researchers, the compromise is not an abstract national‑security story; it is about who can read their emails, impersonate them, or quietly build dossiers that may surface years later.

Key questions now are how many institutions were affected, whether any particularly sensitive departments – such as those involved in defence‑related research or China studies – were among the targets, and how quickly patches and hardening measures can be rolled out across the sprawling universe of academic IT. Signals to watch include follow‑on alerts from national cyber agencies, moves by universities to mandate stronger authentication and mail isolation, and any evidence that the same Roundcube‑focused tradecraft is being recycled against think tanks, NGOs or government contractors.