UNK_MassTraction Exploits Critical Roundcube Vulnerabilities to Compromise University Mail Servers

A sophisticated espionage campaign has been observed targeting university physics and engineering departments through vulnerable Roundcube webmail servers. The attackers exploit patched but unremediated (N-day) vulnerabilities to compromise mail servers rather than simply stealing user credentials. Victims are carefully selected based on their use of vulnerable Roundcube versions, with targets including administrators and professors associated with national security research, astrophysics, and particle physics.

The campaign employs a JavaScript payload named IceCube, which steals credentials, cookies, and two-factor authentication data before chaining a second critical vulnerability to gain remote code execution on the mail server. Depending on the outcome, the attackers deploy either an in-memory PHP web shell called SquareShell or the Go-based remote administration tool VShell, allowing long-term access to compromised systems. Proofpoint assesses the activity as a previously untracked cluster named UNK_MassTraction, noting similarities in tooling previously associated with multiple China-aligned threat actors.

Background of UNK_MassTraction Campaign

The UNK_MassTraction campaign was first observed in May 2026, targeting administrators and professors within U.S. and Canadian university departments involved in engineering, astrophysics, particle physics, and national security research through phishing campaigns.

Rather than indiscriminately targeting Roundcube users, the threat actor appears to conduct reconnaissance beforehand to identify organizations running vulnerable Roundcube versions. Phishing emails originate from compromised sender accounts or spoofed domains protected by weak DMARC policies, increasing the likelihood of successful delivery.

Following successful exploitation, the attackers use compromised Roundcube servers as entry points into institutional networks. Their toolkit includes the custom JavaScript malware IceCube, the in-memory web shell SquareShell, the VShell remote administration tool, and the SNOWLIGHT ELF loader. While SNOWLIGHT and VShell have previously been associated with China-linked activity, there is currently no confirmed evidence directly attributing the UNK_MassTraction campaign to the UNC5174 threat cluster.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Product	Vulnerability Type
CVE-2024-42009	9.3 (Critical)	83.39%	Roundcube through 1.5.7 and 1.6.x through 1.6.7	Cross-Site Scripting (XSS)
CVE-2025-49113	9.9 (Critical)	89.46%	Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11	Post-authenticated Remote Code Execution

The campaign abuses CVE-2024-42009 to execute arbitrary JavaScript within a victim's browser when a malicious email is opened in Roundcube. The stolen session information is then used to exploit CVE-2025-49113, allowing attackers to execute arbitrary code on the underlying mail server.

Attack Methodology

Phase 1: Target Reconnaissance
Attackers identify universities running vulnerable Roundcube installations, focusing on departments associated with physics, engineering, national security, astrophysics, and particle physics. Administrators and professors become the primary phishing targets.

Phase 2: Phishing Delivery
Victims receive phishing emails sent from compromised accounts or spoofed domains with weak DMARC configurations. Opening the email within the Roundcube webmail interface triggers exploitation of CVE-2024-42009, executing attacker-controlled JavaScript in the victim's browser.

Phase 3: JavaScript Payload Execution
The malicious JavaScript payload, IceCube, executes in the victim's browser to collect stored credentials, session cookies, CSRF tokens, two-factor authentication information, browser language, screen resolution, and form data. The harvested information is transmitted to attacker-controlled infrastructure via HTTP POST requests.

Phase 4: Server Compromise
Using the stolen authenticated session and CSRF token, IceCube exploits CVE-2025-49113 to achieve remote code execution on the underlying Roundcube mail server.

Phase 5: Persistence Deployment
Following successful exploitation, the attackers attempt to deploy the in-memory PHP web shell SquareShell through plugins/newmail_notifier/mail_preview.php. If deployment fails, a shell script downloads and launches the SNOWLIGHT ELF loader, which subsequently installs the VShell remote administration tool for persistent access.

Phase 6: Anti-Forensics and Session Manipulation
IceCube monitors user actions such as closing the browser, switching tabs, moving the cursor outside the browser window, or logging out. These events trigger re-exploitation attempts, notify the command-and-control server, and terminate both legitimate and malicious sessions to reduce forensic evidence.

Phase 7: Post-Compromise Operations
Once established, VShell provides persistent remote administration capabilities, enabling attackers to maintain long-term access to compromised mail servers and pivot further into internal institutional networks.

Key Observation: Unlike traditional phishing campaigns focused solely on credential theft, UNK_MassTraction chains browser-based exploitation with server-side remote code execution to compromise Roundcube mail servers, deploy persistent malware, evade forensic analysis, and facilitate long-term access into targeted university environments.

Indicators of Compromise (IOCs)

Malicious Endpoint

plugins/newmail_notifier/mail_preview.php

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1566	Phishing	Initial Access
T1190	Exploit Public-Facing Application	Initial Access
T1059.007	JavaScript	Execution
T1555	Credentials from Password Stores	Credential Access
T1550	Use Alternate Authentication Material	Defense Evasion
T1505.003	Web Shell	Persistence
T1105	Ingress Tool Transfer	Command and Control
T1071.001	Web Protocols	Command and Control
T1078	Valid Accounts	Persistence
T1070	Indicator Removal on Host	Defense Evasion

Visual Attack Flow