Chinese threat group targets UK universities via Roundcube vulnerabilities

Infosecurity Magazine reports that a suspected Chinese threat group is exploiting vulnerabilities in Roundcube webmail servers to compromise university networks in the United States, Canada and the UK. The campaign targets unpatched Roundcube instances to harvest user credentials, gain persistent access to email systems and move laterally into broader university IT infrastructure. Roundcube is an open-source webmail client widely deployed by universities, research institutions and other organisations that operate their own email infrastructure. The threat group is using known vulnerabilities in Roundcube to bypass authentication and inject malicious code, enabling them to intercept emails, steal credentials and establish long-term access to compromised systems. The targeting of universities is consistent with broader patterns of espionage-focused activity aimed at research data, intellectual property and academic collaboration networks.

Why this matters for UK organisations

For UK organisations, particularly those in higher education, research and sectors with significant intellectual property, this is a reminder that webmail and collaboration platforms are high-value targets for espionage-focused threat actors. Universities often operate complex, federated IT environments with large user populations, legacy systems and limited central visibility, making them attractive targets for persistent access campaigns. The operational risk extends beyond email compromise: access to university networks can enable theft of research data, grant applications, student records and credentials that can be used to access partner institutions or commercial collaborators. The targeting of UK universities also highlights the broader risk to organisations that collaborate with academic institutions, as compromised university accounts can be used to launch supply chain attacks or gain access to partner networks. Organisations should ensure that Roundcube and other self-hosted webmail platforms are patched, monitored and included in regular security reviews, and that there is visibility into unusual authentication patterns, credential use and lateral movement within email systems.

What to review

Review whether Roundcube or other self-hosted webmail platforms are in use across the organisation, ensure they are up to date, and review authentication logs for unusual access patterns or credential harvesting activity. Consider whether email systems are included in regular vulnerability assessments and whether there is a process for reviewing access logs and authentication activity. Ensure there is monitoring in place to detect unusual email forwarding rules, credential use from unexpected locations or lateral movement from email systems into broader IT infrastructure. This is also a prompt to review whether there is clear ownership and accountability for patching and monitoring self-hosted webmail platforms, and whether these systems are treated with the same level of security rigour as other internet-facing services. Organisations should also consider whether there is a process for reviewing and responding to unusual authentication activity, and whether there is visibility into how email systems are being used to access other services or partner networks.

Source: Infosecurity Magazine