Suspected China-Aligned Cluster Targets University Roundcube Servers
Summary
Proofpoint reports UNK_MassTraction has targeted U.S. and Canadian universities via malicious emails exploiting Roundcube flaws CVE-2024-42009 and CVE-2025-49113 to steal credentials and deploy backdoors. China alignment is a low-confidence assessment.
Key points
- Proofpoint tracks the activity as UNK_MassTraction and says it has targeted universities in the U.S. and Canada, including physics, engineering, and national security-related research organizations.
- Malicious emails, sent from compromised accounts or spoofed domains, exploit Roundcube’s CVE-2024-42009 cross-site scripting flaw to load the IceCube stealer.
- Researchers say IceCube can collect usernames, passwords, cookies, two-factor authentication data, and browser information.
- IceCube also attempts to exploit Roundcube’s CVE-2025-49113 deserialization flaw to install SquareShell, a PHP webshell with remote code execution capabilities.
- If SquareShell is not installed, the malware downloads a shell script that loads the VShell backdoor in memory; VShell supports interactive shell access and port forwarding.
- Proofpoint assesses that the cluster is likely China-aligned, citing infrastructure overlap and Chinese-language artifacts, but says the attribution is not high-confidence.
- Administrators are advised to apply security updates addressing both Roundcube flaws and secure mail servers like other remote-access systems.
Article Details
- Event Type
- Cyber espionage campaign exploiting Roundcube vulnerabilities
- Impact
- The China-linked cluster UNK_MassTraction has targeted university mail servers in the United States and Canada to steal credentials and deploy backdoors. The reported payloads can collect passwords, cookies, two-factor authentication data, and browser information; successful installation of SquareShell can provide remote code execution on a mail server, while VShell provides remote access capabilities. Proofpoint describes the China-alignment attribution as an assessment with low confidence.
MITRE ATT&CK
T1105 · Ingress Tool TransferThe malware downloads a shell script that loads the VShell payload.T1190 · Exploit Public-Facing ApplicationThe attackers exploit vulnerabilities in internet-facing Roundcube mail servers.T1505.003 · Web ShellThe attackers attempt to install SquareShell, described as a PHP webshell.
CVE
CVE-2024-42009Roundcube · WebmailThe campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell.CVE-2025-49113Roundcube · WebmailThe campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell.
Threat Actors
Malware
IceCubeThe campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell.SquareShellThe campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell.VshellThe campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell.