Suspected Chinese Threat Group Targets Universities via Vulnerable Roundcube Servers

Proofpoint tracked a China-aligned cluster, UNK_MassTraction, exploiting Roundcube vulnerabilities (CVE-2024-42009 XSS and CVE-2025-49113 deserialization) at U.S. and Canadian universities to steal credentials via an IceCube JavaScript payload and to deploy webshells and the VShell in-memory backdoor for follow-on access; the activity targeted physics and engineering departments and is assessed as espionage-focused.