At a glance Actor UNK_MassTraction — suspected China-aligned espionage cluster Activity Roundcube exploitation for credential theft, webshells, and the VShell backdoor Targets Physics and engineering departments at US and Canadian universities Scale Fewer than 10 confirmed victims; a few dozen possibly impacted (Proofpoint) Law-enforcement status No arrests or charges; victims notified with partners Source Proofpoint Threat Research TL;DR Proofpoint is tracking a suspected…

Sometimes a single opened email is all it takes to compromise a university network. Researchers at Proofpoint have uncovered a campaign they call UNK_MassTraction. A threat group believed to have ties to China was responsible. It compromised Roundcube mail servers at physics and engineering departments across universities in the United States and Canada. Campaign Scope and Target Selection The campaign has been active since at least May 2026.