China-Linked Cluster UAT-7810 Exploiting Roundcube Servers at US and Canadian Universities to Deploy Backdoors and Harvest Credentials

A China-linked threat cluster tracked as UAT-7810 is actively exploiting unpatched Roundcube webmail servers at U.S. and Canadian universities to steal credentials and establish persistent backdoor access, according to reporting from BleepingComputer. The targeting of academic institutions aligns with longstanding PRC intelligence collection priorities around defense research, dual-use technology, and government-adjacent scholarship programs. Universities running self-hosted Roundcube instances should apply all available patches immediately and audit for indicators of unauthorized access or mail exfiltration.

The targeting of academic institutions aligns with longstanding PRC intelligence collection priorities around defense research, dual-use technology, and government-adjacent scholarship programs.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.