UNK_MassTraction Exploits Roundcube Flaws Against US, Canadian Universities

Proofpoint has uncovered an active, China-aligned espionage campaign (UNK_MassTraction) exploiting Roundcube vulnerabilities to compromise university mail servers—particularly physics and engineering departments tied to sensitive research. Attackers leverage CVE-2024-42009 (Roundcube XSS) to load a JavaScript loader called IceCube that harvests credentials and session data, then chain to CVE-2025-49113 (Crypt_GPG deserialization) to install SquareShell (a PHP web shell) and deploy VShell, an in-memory Go backdoor; operators also perform cleanup and persistence and reuse compromised accounts/domains. Proofpoint has provided IOCs (IPs, hashes, URLs) and recommends patching exposed Roundcube instances and reviewing logs and web directories.