Suspected Chinese snoops caught breaking into universities' Roundcube mailservers

Proofpoint researchers observed an ongoing espionage campaign (tracked as UNK_MassTraction) targeting US and Canadian universities by exploiting a Roundcube XSS (CVE-2024-42009) to run a JavaScript loader that delivers the IceCube stealer, which harvests credentials and session tokens. The attackers then used a Roundcube deserialization vulnerability (CVE-2025-49113) to install SquareShell webshells and VShell implants; fallback loaders (SnowLight-related) and shared infrastructure point to China-aligned actors targeting physics, engineering, and national-security-related departments.