cyber.hendryadrian.com
Security News · cyberscoop.com

Proofpoint Links Roundcube Exploit Campaign Against Universities to China-Aligned Cluster

· Original article ↗

Summary

Proofpoint says the UNK_MassTraction cluster used two Roundcube flaws to target U.S. and Canadian universities. Researchers confirmed fewer than 10 victims and say they lack evidence about what, if anything, was stolen.

Key points

  • Proofpoint reports that the campaign targeted physics and engineering departments at U.S. and Canadian universities, including staff with national-security ties.
  • Researchers confirmed fewer than 10 university victims and estimated that a few dozen may be affected; they believe the campaign is ongoing.
  • Proofpoint says attackers chained CVE-2024-42009, which enabled JavaScript execution in a victim’s browser, with CVE-2025-49113 to gain a foothold in a mail server.
  • The initial exploit reportedly required a victim to open an email containing a generic lure.
  • Proofpoint tracks the cluster as UNK_MassTraction and attributes it to a China-aligned group based on shared covert infrastructure, an infection chain leading to VShell, and Chinese-language artifacts in phishing emails.
  • Researchers said they observed initial inbound email attempts and had no data establishing what was stolen.

Article Details

Event Type
Espionage-motivated intrusion campaign against U.S. and Canadian universities using a chained Roundcube exploit.
Impact
Proofpoint reported fewer than 10 confirmed university victims and estimated that a few dozen universities may be affected. The campaign targeted physics and engineering departments and sought sensitive data while establishing persistent access through webshells and backdoors. Researchers said they lacked data to determine what, if anything, was stolen; Proofpoint believes the campaign is ongoing.

MITRE ATT&CK

T1505.003 · Web ShellThe attackers used webshells to maintain persistent access to compromised university networks.

CVE

CVE-2024-42009Roundcube · WebmailThe campaign targeted physics and engineering departments and used Roundcube flaws CVE-2024-42009 and CVE-2025-49113 to gain access, with evidence pointing to the threat cluster UNK_MassTraction and the use of VShell.CVE-2025-49113Roundcube · WebmailThe campaign targeted physics and engineering departments and used Roundcube flaws CVE-2024-42009 and CVE-2025-49113 to gain access, with evidence pointing to the threat cluster UNK_MassTraction and the use of VShell.

People

Greg LesnewichPrincipal threat researcher at Proofpoint who discussed the campaign, victim estimates, and limits of the available evidence.

Threat Actors

UNK_MassTractionProofpoint tracks the cluster as UNK_MassTraction and attributes the university intrusions to it. Proofpoint describes the cluster as China-aligned, citing a covert network used by multiple China-aligned groups, an infection chain leading to VShell, and Chinese-language artifacts in phishing emails.

Malware

VshellThe campaign targeted physics and engineering departments and used Roundcube flaws CVE-2024-42009 and CVE-2025-49113 to gain access, with evidence pointing to the threat cluster UNK_MassTraction and the use of VShell.

Products

Roundcube WebmailThe campaign targeted physics and engineering departments and used Roundcube flaws CVE-2024-42009 and CVE-2025-49113 to gain access, with evidence pointing to the threat cluster UNK_MassTraction and the use of VShell.

Countries

CanadaRead More: https://cyberscoop.com/china-espionage-attacks-us-canada-universities-proofpoint/ChinaChina-aligned attackers breached U.S. and Canadian university networks to steal sensitive data and maintain persistent access through webshells and backdoors.United StatesChina-aligned attackers breached U.S. and Canadian university networks to steal sensitive data and maintain persistent access through webshells and backdoors.

Related Articles