China-Aligned Hackers Exploit Roundcube Flaws to Target Universities
A suspected China-aligned threat cluster, tracked by Proofpoint as UNK_MassTraction, has been exploiting patched vulnerabilities in Roundcube webmail to compromise physics and engineering departments at U.S. and Canadian universities. First detected in May 2026, the campaign primarily targets administrators and professors tied to national security research, astrophysics, and particle physics programs. Attackers leveraged compromised senders and spoofable domains with weak DMARC policies to deliver phishing emails—researchers warn that the use of generic lures suggests broader targeting beyond current visibility, making proactive monitoring through an email breach checker essential for academic institutions.
The exploit chain begins with CVE-2024-42009, a critical cross-site scripting flaw (CVSS 9.3) that fires the moment a recipient opens the malicious email in a vulnerable Roundcube client. Proofpoint researchers Greg Lesnewich and Mark Kelly note the actor likely conducted reconnaissance to identify departments running susceptible versions before launching the campaign. The resulting payload, dubbed IceCube, harvests stored credentials, two-factor authentication tokens, and cookies while collecting browser fingerprint data—including language settings and screen dimensions—before exfiltrating the bundle via HTTP POST. Security teams can audit exposure using a browser fingerprint test to identify what client telemetry is being leaked.
IceCube then leverages the stolen session CSRF token to weaponize a second flaw, CVE-2025-49113 (CVSS 9.9), achieving post-authenticated remote code execution on the mail server. Operators deploy either VShell, a known post-exploitation tool, or SquareShell—an in-memory PHP web shell reachable at the endpoint plugins/newmail_notifier/mail_preview.php—giving the threat actor persistent footholds designed to evade detection. By abusing Roundcube servers as pivot points, the cluster can move laterally into higher-value research networks. Organizations running legacy Roundcube deployments should audit credentials immediately via a password checker and rotate any secrets that may have transited compromised mail servers, while ensuring all instances are patched against both 2024 and 2025 vulnerabilities.