UNK_MassTraction exploits Roundcube vulnerabilities to target university physics and engineering departments

Summary

Since May 2026, the threat cluster UNK_MassTraction has been conducting targeted campaigns against academic institutions. The attackers focus on professors and administrators within departments related to astrophysics, particle physics, and national security-related research. By targeting specific departments, the group appears to have performed reconnaissance to identify servers running vulnerable versions of the Roundcube webmail client.

The attack chain begins with a phishing email that, when opened in a vulnerable Roundcube instance, triggers a cross-site scripting (XSS) flaw. This allows the attacker to steal session data and credentials before moving to exploit a second vulnerability to gain remote code execution on the mail server itself.

What happened

The campaign utilizes a multi-stage infection chain designed to pivot from a victim's browser into the underlying mail server. The initial stage involves an XSS vulnerability, CVE-2024-42009, which occurs because Roundcube does not adequately sanitize JavaScript items in HTML. An attacker can trigger this via the onanimationstart function when a user opens a malicious email.

Once the script executes, it loads "IceCube," a specialized Roundcube stealer. IceCube performs DOM traversal to escape the webmail iFrame, granting it access to the full authentication session. The malware harvests usernames, passwords, two-factor authentication (2FA) data, and browser information before sending it to a command-and-control (C&C) server.

Technical details

After harvesting credentials, IceCube uses "helpers" to target a second vulnerability: a deserialization flaw tracked as CVE-2025-49113. This flaw involves the parsing of the Crypt_GPG_Engine. By sending specially crafted PHP serialized data to the Roundcube database, the attacker can trigger the execution of embedded commands when the object is deserialized.

The attack follows two primary paths depending on success:

• Webshell Deployment: The exploit attempts to write a PHP webshell named SquareShell to the server at plugins/newmail_notifier/mail_preview.php. This shell is timestomped to match legitimate plugin modification times and can execute commands via utilities such as system, exec, or passthru.
• In-Memory Backdoor: If the webshell deployment fails, a fallback mechanism downloads a shell script that deplos an architecture-dependent ELF loader. This loader executes the VShell backdoor directly in memory under the process name [kworker/0:2].

VShell is a Go-based tool used for interactive shell access and port forwarding, frequently seen in Chinese-linked intrusions.

Why this matters for defenders

The attackers are not just looking for email access; they are using Roundcube as a pivot point to enter internal university networks. The presence of VShell suggests the intent is long-term access and lateral movement.

The targeting of specific departments indicates that the group conducts reconnaissance to find vulnerable, internet-facing mail servers. This makes the webmail client a high-value entry point for gaining a foothold in academic environments.

Defender guidance

Administrators should treat Roundcube installations with the same level of scrutiny as VPN or remote access nodes.

• Apply Security Updates: Immediately update Roundcube to versions that address CVE-2024-42009 and CVE-2025-49113.
• Monitor for Webshells: Check the plugins/newmail_notifier/ directory for unauthorized files, specifically mail_preview.php.
• Inspect Process Activity: Look for suspicious processes such as [kworker/0:2] or unexpected Go-based binaries running in memory on Linux mail servers.
• Review File Integrity: Monitor for the presence of /tmp/log_de.log, which is used by the VShell loader to check for existing infections.
• Strengthen Email Security: Since attackers use spoofed domains and compromised accounts, ensure DMARC policies are strictly enforced to prevent email-based redirection and spoofing.