A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering departments of U.S. and Canadian universities as part of a new campaign.
The activity involves the exploitation of now-patched, critical security flaws in the open-source email solution, such as CVE-2024-42009 (CVSS score: 9.3), to siphon credentials, followed by either the deployment of a web shell for persistent access or a known post-exploitation tool called VShell.
The emerging threat cluster is being tracked by Proofpoint under the moniker UNK_MassTraction. It was first detected in May 2026, specifically focusing on administrators and professors in departments with either national security ties or entities studying astrophysics and particle physics.
“The emails targeting university departments used both compromised senders, as well as abused domains vulnerable to spoofing due to lax DMARC policy to send the emails,” the enterprise security company wrote in a technical report shared with The Hacker News, adding the use of generic lures indicates a “larger targeting swath” beyond its visibility.
While the nature of the cross-site scripting (XSS) exploit is such that it only requires the recipient to open the email in the Roundcube client in order to obtain access to the mail server, it’s assessed that the targeted departments were singled out because they were all running versions of Roundcube susceptible to N-day security flaws.
This indicates that the threat actor likely carried out preparatory reconnaissance into these targets to gather information about their environments prior to sending phishing emails that trigger an exploit for CVE-2024-42009 and execute arbitrary JavaScript code in the context of the victim’s web browser.
“The actor is likely abusing Roundcube servers as a pivot point to enter target networks, and the operators have deliberately crafted their infection chain to avoid detection,” Proofpoint researchers Greg Lesnewich and Mark Kelly said.
The payload delivered following the exploitation of the XSS flaw, codenamed IceCube, is designed to siphon credential information stored in the browser along with two-factor authentication (2FA) and cookies. It also carries out reconnaissance of its own to collect information about the browser language, screen size, and form field values. screen size, and form field values.
The harvested information is sent to an external system by means of an HTTP POST request. In the next step, IceCube leverages the session’s CSRF token to weaponize a second post-authenticated remote code execution flaw in Roundcube – CVE-2025-49113 (CVSS score: 9.9) – with the goal of obtaining a foothold in the mail server and dropping VShell or a web shell dubbed SquareShell in memory.
The web shell, deployed by means of a PHP gadget shell command, is remotely reachable at the endpoint “plugins/newmail_notifier/mail_preview.php” and enables arbitrary code…
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
