Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
Security researchers at Proofpoint have uncovered a campaign, attributed to a suspected China-aligned cluster labeled UNK_MassTraction, that exploited vulnerabilities in the Roundcube webmail platform to target physics and engineering units at universities in the United States and Canada. The intrusions rely on now-patched, high-severity bugs in the open-source mail client to harvest credentials and then move to obtain persistent access on compromised mail servers.
According to the report, attackers abused CVE-2024-42009 – an XSS flaw rated 9.3 by CVSS – to siphon login data, then either installed an in-memory web shell or dropped a known post-exploitation tool called VShell. Proofpoint first spotted the cluster in May 2026 and says the campaign focused on administrators and faculty in departments that have connections to national security work or research in astrophysics and particle physics.
Proofpoint noted the phishing emails were sent from a mix of legitimately compromised accounts and from domains susceptible to spoofing because of weak or absent DMARC policies. The lures used were generically worded, an indicator that the perpetrators likely cast a wide net beyond the specific victims visible to investigators.
The exploited XSS in Roundcube requires only that an email be opened inside the Roundcube client for the attacker to gain an avenue into the mail server. Researchers assess the adversary targeted groups whose Roundcube instances were still vulnerable to N-day flaws, suggesting the intruders conducted reconnaissance to inventory software versions and other environment details before dispatching the malicious messages that trigger CVE-2024-42009 and run arbitrary JavaScript in the victim’s browser.
Proofpoint researchers Greg Lesnewich and Mark Kelly conclude the actor appears to be leveraging compromised Roundcube servers as a pivot into wider networks, and that the infection chain has been specifically engineered to evade detection.
The initial JavaScript payload – tracked under the name IceCube – is built to harvest credentials stored in the browser, capture two-factor authentication data and cookies, and collect environment metadata such as browser language, screen resolution and form contents. This information is exfiltrated to an external server via an HTTP POST request.
After collecting session details, IceCube uses the session’s CSRF token to weaponize a second, post-authenticated remote code execution flaw in Roundcube: CVE-2025-49113, which carries a 9.9 CVSS rating. The exploit’s objective is to gain a foothold on the mail server and drop either VShell or an in-memory PHP web shell dubbed SquareShell. The web shell is reachable at the endpoint plugins/newmail_notifier/mail_preview.php and permits arbitrary code execution through a PHP gadget-based command.
If the attempt to install SquareShell fails, the attackers now have a fallback mechanism: a shell script that runs via the Roundcube vulnerability to ultimately fetch and execute VShell. This secondary route was added in June 2026; previously the chain would abort if SquareShell deployment did not succeed.
The shell script acts as a downloader for an ELF loader known as SNOWLIGHT, selecting and fetching a build that matches the host architecture before launching it. Both SNOWLIGHT and VShell have been associated in the past with a China-linked cluster tracked as UNC5174, indicating the script may be a shared resource among multiple China-nexus operations – similar in distribution to commodity backdoors like ShadowPad.
Proofpoint describes additional stealth measures: IceCube registers “deferred triggers” that monitor user behavior (for example, closing the page, switching tabs, mouse movement out of the browser window) and hijacks the logout button. If any of these actions occur, the script hooks those events, attempts another exploit of CVE-2025-49113 and signals the command-and-control infrastructure that the Roundcube session was abandoned. Following completion or timeout, the JavaScript attempts to remove evidence by terminating both user and attacker-initiated sessions on the server, forcing a logout and erasing traces from the Roundcube instance.
VShell, written in Go, provides post-compromise management and capabilities comparable to commercial red-team frameworks like Cobalt Strike and has been used by various China-aligned actors in recent years. Proofpoint points out that this is the first documented instance of a Chinese-linked group exploiting Roundcube flaws; prior abuse of the platform has typically been attributed to Russian state-backed actors.
Summing up, Proofpoint researchers warn that, while the attackers are unlikely to be solving deep theoretical problems in the targeted departments, UNK_MassTraction demonstrated a polished toolset and a distinctive approach to abusing N-day vulnerabilities. The campaign is a reminder that email delivery systems can be abused to compromise mail servers, and defenders should treat mail servers with the same rigor as VPN concentrators and other remote access points.