Sometimes a single opened email is all it takes to compromise a university network. Researchers at Proofpoint have uncovered a campaign they call UNK_MassTraction. A threat group believed to have ties to China was responsible. It compromised Roundcube mail servers at physics and engineering departments across universities in the United States and Canada. Campaign Scope and Target Selection The campaign has been active since at least May 2026.