Malware
SquareShell
- First Reported
- Jul 7, 2026
- Latest Reported
- Jul 8, 2026
Reported Context (2)
- The campaign uses malicious emails to trigger Roundcube flaws CVE-2024-42009 and CVE-2025-49113, leading to payloads such as IceCube, SquareShell, and VShell. Suspected China-Aligned Cluster Targets University Roundcube Servers
- The intrusions deployed the IceCube stealer, SquareShell webshell, and VShell backdoor while using layered evasion, persistence, and fallback mechanisms to maintain access. Proofpoint Details UNK_MassTraction Campaign Exploiting Roundcube to Steal University Credentials
CVE (2)
Malware (3)
Threat Actors (1)
MITRE ATT&CK (11)
Products (1)
Industries (1)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.