China-Aligned UNK_MassTraction Exploits Roundcube Servers to Target Universities

Proofpoint observed a China-aligned cluster dubbed UNK_MassTraction exploiting Roundcube XSS (CVE-2024-42009) to run an IceCube JavaScript stealer that harvests credentials and session data, then using a Crypt_GPG_Engine deserialization flaw (CVE-2025-49113) to deploy SquareShell webshells or an in-memory Go backdoor (VShell) on university mail servers; the report provides technical details, IOCs (IPs, URLs, SHA256), attribution indicators, and mitigation guidance including patching, DMARC enforcement, credential rotation, and searching for timestomped webshells.