What happened
A threat cluster with suspected ties to China exploited critical, now-patched vulnerabilities in Roundcube webmail — including CVE-2024-42009, carrying a CVSS score of 9.3 — to steal credentials from physics and engineering departments at U.S. and Canadian universities. The campaign targeted the open-source email platform specifically within research-heavy academic units, suggesting deliberate interest in scientific and technical intellectual property. Separately, the FBI coordinated with industry partners to seize hundreds of domains tied to NetNut, a residential proxy service operated by Nasdaq-listed Israeli firm Alarum Technologies. The seizure followed investigative reporting linking NetNut to the Popa botnet, a network of compromised devices used to mask malicious traffic.
Why it matters for your business
Organizations still running unpatched versions of Roundcube face active exploitation risk; the severity of CVE-2024-42009 means attackers can harvest credentials without user interaction, making routine patch cycles non-negotiable. For security and operations teams, the NetNut seizure is a reminder that legitimate-looking commercial proxy services can serve as laundry infrastructure for state and criminal actors — complicating threat attribution and firewall allowlisting. Practically, IT leaders should audit any third-party proxy or anonymization services in their vendor stack and cross-reference them against newly sanctioned or seized infrastructure lists. Academic institutions and R&D-focused firms should treat their email servers as high-value targets warranting the same hardening standards applied to production databases.
What to watch next
Alarum Technologies faces significant reputational and regulatory pressure following the FBI action; watch for further disclosures about the scope of the Popa botnet and whether additional commercial proxy providers face scrutiny. On the espionage front, the focus on STEM university departments fits a broader pattern of technology-transfer targeting that has drawn Congressional attention — further indictments or attribution statements from the Justice Department are plausible. Security teams should monitor Roundcube's release channel closely, as threat actors historically pivot to newly disclosed CVEs in the same software family once one exploit chain is publicly confirmed.