Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities

# Chinese APT Uses Critical Roundcube Flaws to Breach U.S. University Networks, Targeting Defense-Research Departments

## The Threat

A suspected China-aligned threat cluster tracked by Proofpoint as UNK_MassTraction has launched a coordinated campaign exploiting critical vulnerabilities in Roundcube webmail servers to breach physics and engineering departments at U.S. and Canadian universities. The operation, first detected in May 2026, employs a sophisticated attack chain that chains together two critical Roundcube flaws to move from initial webmail compromise to full network persistence—suggesting that the attackers conducted detailed reconnaissance of their targets before launching phishing campaigns.

The attack begins with a phishing email crafted to look legitimate, often sent from spoofed university domains. When a targeted administrator or professor opens the email in their Roundcube client, a cross-site scripting (XSS) payload exploits CVE-2024-42009 to execute arbitrary JavaScript in the browser context. This first-stage payload, dubbed IceCube, extracts session cookies, stored credentials, two-factor authentication tokens, and browser metadata—all without raising user-facing alerts. That harvested authentication data is then weaponized against a second, post-authenticated remote code execution flaw (CVE-2025-49113), allowing the attackers to drop persistent web shells (SquareShell) or known post-exploitation tools (VShell) directly onto the compromised mail server.

What makes this campaign particularly concerning is its targeting strategy: the threat actors appear to have specifically identified universities with physics and engineering departments involved in nationally sensitive research—astrophysics, particle physics, and domains with explicit national security relevance. The combination of reconnaissance, multi-stage exploitation, and immediate deployment of command-and-control infrastructure suggests this is not opportunistic spam malware, but a deliberate espionage operation designed to establish long-term access to university research networks.

## Severity and Impact

| Aspect | Details |

|---|---|

| CVE-2024-42009 | XSS vulnerability in Roundcube email client; CVSS 9.3 (Critical) |

| CVSS Vector (9.3) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |

| Attack Complexity | Low—requires only that the victim open an email in Roundcube |

| Authentication Required | No—initial XSS requires no prior authentication |

| CVE-2025-49113 | Post-authenticated RCE in Roundcube; CVSS 9.9 (Critical) |

| CVSS Vector (9.9) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |

| Attack Complexity | Low—exploitable immediately after session hijacking via CVE-2024-42009 |

| Authentication Required | Yes—requires valid session obtained from CVE-2024-42009 |

| CWE References | CWE-79 (Improper Neutralization of Input During Web Page Generation) |

| Threat Actor | UNK_MassTraction (suspected China-aligned, linked to UNC5174) |

| First Observed | May 2026 |

## Affected Products

Roundcube Webmail:

Note: The campaign targeted institutions running unpatched or legacy versions of Roundcube. Organizations operating current, fully patched installations are significantly less exposed.

## Mitigations

Immediate Actions:

Network-Level Controls:

Detection and Response:

## References

---

## HackWire Analysis

This campaign reveals a critical gap in how U.S. universities protect research infrastructure. Physics and engineering departments at academic institutions have become high-value espionage targets for state-aligned adversaries—not because universities are easy to breach, but because they house unclassified research with genuine national security implications. Particle physics experiments, quantum computing research, and advanced materials science are all publicly interesting but strategically significant, and the targeting of professors and administrators suggests the attackers understood exactly which departments to pursue.

The technical sophistication here is noteworthy. Rather than blanket phishing or exploit kits, UNK_MassTraction conducted reconnaissance to identify institutions running vulnerable Roundcube versions, then weaponized a two-stage attack that avoids many common detections. The XSS-to-RCE chain is elegant: the first stage operates entirely in the browser without filesystem artifacts, while the second stage (CVE-2025-49113) requires no additional user interaction once credentials are stolen. This is not spray-and-pray malware; this is targeted espionage tradecraft.

What's particularly concerning is the fallback mechanism introduced in June 2026. When SquareShell deployment failed on some targets, the attackers added an alternate shell script delivery path for SNOWLIGHT. This indicates the campaign is *active, adaptive, and ongoing*—not a one-time operation. The use of SNOWLIGHT (previously linked to UNC5174, another China-attributed cluster) also suggests either tool sharing among Chinese APT groups or potential coordination between units, similar to how ShadowPad is distributed across the Chinese intelligence apparatus.

For universities and research institutions: Roundcube patches are available now. Deploy them. Audit your mail servers. If you host research with national security relevance, assume you are being targeted. For CISOs and security teams: this is a reminder that webmail is often the forgotten network perimeter. It gets patched last, monitored least, and represents a direct bridge into research networks and faculty correspondence containing unpublished findings. Treat your mail infrastructure like the crown jewel it actually is.

— HackWire Editorial

## Related Coverage