Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities

A China-aligned threat actor cluster, tracked as UNC5174 and linked to ShadowPad, has been exploiting vulnerabilities in Roundcube webmail software at U.S. and Canadian universities. The campaign leverages CVE-2024-42009 and CVE-2025-49113 to gain access, deploying tools like VShell and SquareShell to establish a footh…