Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
Summary: Proofpoint tracked a suspected China-aligned cluster it calls UNK_MassTraction exploiting Roundcube webmail at U.S. and Canadian university physics and engineering departments, first detected in May 2026, using the XSS flaw CVE-2024-42009 (CVSS 9.3) to steal credentials and then the post-authenticated flaw CVE-2025-49113 (CVSS 9.9) to drop VShell or a web shell called SquareShell. The IceCube payload harvests browser credentials, 2FA codes and cookies, sets deferred triggers that re-attempt exploitation when a user closes the page or leaves the window, and then destroys sessions to erase forensic evidence.
What's compelling: The exploit only needs the recipient to open the email in the Roundcube client, and Proofpoint says the targeted departments were singled out because they ran versions vulnerable to N-day flaws - meaning unpatched mail servers, not user mistakes, were the entry point.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-42009CVE-2025-49113
- Related
- CVE-2025-49113: Round Cube Webmail Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Feb 20, 2026CVE-2024-42009: Round Cube Webmail Cross-Site Scripting Vulnerability Known Exploited Vulnerabilities · Jun 09, 2025