A suspected China-aligned cluster is tied to Roundcube exploitation, showing how a browser-side XSS bug can become a gateway into university mail infrastructure.