Hackers Exploit Roundcube Vulnerability to Spy on Academics

Security researchers have documented a cyberespionage campaign in which attackers are exploiting a vulnerability in the Roundcube webmail client to target educational institutions.

Who Is Behind the Attacks

According to analysts, the campaign is the work of a China-linked cybercriminal group. Its targets are Roundcube servers deployed at universities in the US and Canada.

The Goals of the Attacks

The attackers exploit a vulnerability in Roundcube to gain unauthorized access to the mail systems of these institutions. Once inside, they steal users' credentials, which lets them reach additional resources within the compromised networks.

Beyond stealing credentials, the hackers install backdoors on the infected servers — malicious software that provides covert, persistent access to the system. This allows the group to return to the compromised infrastructure even after the original vulnerability has been patched.

Why It Matters

Universities are frequently targeted for espionage, since their networks hold data from research projects, including those tied to sensitive or cutting-edge fields of science. Compromising mail servers gives attackers the ability to monitor researchers' correspondence and access internal communications without the victims' knowledge.

Roundcube remains one of the most widely used web interfaces for handling email at educational and corporate organizations, which makes vulnerabilities in this product especially attractive to espionage-oriented attackers.

Mail server administrators are advised to apply security updates promptly and to review their logs for signs of compromise.

Source: Bleeping Computer