A China-linked threat group has been hitting vulnerable Roundcube servers at US and Canadian universities. Their targets? Physics and engineering departments. Professors, administrators, and researchers involved in astrophysics, particle physics, and national security work.
Proofpoint is tracking this as UNK_MassTraction. The campaign has been active since May.
Here’s how it works. A malicious email arrives from a compromised account or spoofed domain — generic lure, nothing fancy. Opening it in a vulnerable Roundcube webmail client triggers a cross-site scripting flaw. That’s CVE-2024-42009, and it executes JavaScript in the victim’s browser to load a payload called IceCube.
IceCube is a full-on Roundcube stealer. It grabs usernames, passwords, cookies, 2FA data, and browser info. If the stars align for the attacker, the malware exploits a deserialization flaw — CVE-2025-49113 — to install SquareShell, a PHP webshell with remote code execution capabilities.
No RCE? No problem. The malware falls back to dumping a shell script that loads VShell directly in memory. That’s a Go-based backdoor supporting interactive shell access and port forwarding. It’s commonly used by Chinese threat actors.
Proofpoint assesses this is likely a China-aligned espionage group. The infrastructure overlaps with a covert VPS network linked to multiple Chinese actors. There are Chinese-language artifacts in earlier phishing emails. And targeting internet-facing mail servers as a foothold into internal networks is a hallmark of Chinese attacks.
That said, Proofpoint emphasizes this is just an assessment — not high confidence.
Interestingly, UNK_MassTraction seems to have pre-scanned for servers vulnerable to CVE-2024-42009 and CVE-2025-49113 before striking. That means they did their homework.
Roundcube admins: apply the latest security patches. Treat your mail servers like you treat your VPNs — because attackers certainly do.
