Hackers exploit Roundcube flaw to spy on academic researchers

Proofpoint reports an active China-linked espionage campaign named UNK_MassTraction that exploits Roundcube vulnerabilities (CVE-2024-42009 and CVE-2025-49113) to deliver a credential stealer (IceCube), attempt installation of a PHP webshell (SquareShell), and deploy a Go-based backdoor (VShell), targeting physics, engineering, and national-security-related research at U.S. and Canadian universities; defenders are urged to apply patches and treat mail servers as high-risk remote-access points.