China-linked Hackers Target Universities via Roundcube Vulnerabilities

A China-linked threat group has been exploiting vulnerabilities in Roundcube webmail servers at universities across the United States and Canada, targeting academic researchers to steal credentials and deploy backdoor malware. This campaign, identified by cybersecurity firm Proofpoint as UNK_MassTraction, has been active since May and primarily focuses on physics and engineering departments, as well as organizations involved in astrophysics and national security research.

The attack begins with the delivery of a malicious email, which may originate from compromised accounts or spoofed domains. When a recipient opens the email in a vulnerable Roundcube webmail client, it triggers a cross-site scripting flaw, tracked as CVE-2024-42009. This flaw allows the execution of JavaScript code in the victim's browser, which loads a payload known as IceCube.

IceCube is described by researchers as a fully-featured Roundcube stealer capable of harvesting usernames, passwords, cookies, two-factor authentication (2FA) data, and browser information. The malware employs additional techniques to exploit a Roundcube deserialization flaw, tracked as CVE-2025-49113, and attempts to install SquareShell, a PHP webshell that provides remote code execution capabilities. If this installation fails, the malware resorts to downloading a shell script that loads another payload, VShell, directly into memory. VShell is a Go-based backdoor that enables interactive shell access and port forwarding, commonly used by Chinese threat actors.

Proofpoint assesses that UNK_MassTraction is likely a China-aligned espionage actor based on several observations. The infrastructure used in these attacks overlaps with a covert VPS network previously linked to multiple China-associated actors. Additionally, earlier phishing emails contained Chinese-language artifacts, further supporting this assessment. The tactic of targeting internet-facing mail servers to gain access to internal networks is also characteristic of Chinese cyber operations.

While Proofpoint emphasizes that their attribution is an assessment and not a high-confidence conclusion, they note that the specific targeting of this campaign suggests that reconnaissance was conducted prior to the attacks. The attackers appear to have selected servers previously identified as vulnerable to the two mentioned flaws.

In light of these developments, administrators of Roundcube systems are urged to apply the latest security updates addressing CVE-2024-42009 and CVE-2025-49113. Security teams are reminded to treat mail servers with the same level of diligence as they do for VPNs and other remote access nodes, as a significant percentage of successful attacks go undetected.