Cyber‑security firm Proofpoint has identified a new espionage campaign, dubbed UNK_MassTraction, that has been active since May 2026. The group, believed to be China‑linked, is systematically compromising Roundcube webmail installations at major U.S. and Canadian universities, focusing on physics and engineering departments, senior administrators, and researchers involved in astrophysics, particle physics, and defense‑related projects.

Attack Mechanics

The operation begins with a malicious email sent from compromised accounts or spoofed domains, using a generic lure. When a recipient opens the message in a vulnerable Roundcube client, a cross‑site scripting flaw (CVE‑2024‑42009) triggers JavaScript execution, loading a payload named IceCube. IceCube is a full‑featured Roundcube stealer that extracts usernames, passwords, cookies, two‑factor authentication tokens, and browser fingerprints.

Subsequently, the malware leverages a deserialization vulnerability (CVE‑2025‑49113) to drop a PHP web‑shell called SquareShell. If successful, attackers gain remote code execution (RCE) on the mail server. In the event of failure, a secondary script downloads a memory‑resident Go‑based backdoor, VShell, which provides interactive shell access and port‑forwarding—capabilities commonly associated with Chinese threat actors.

Why Analysts Link It to China

Proofpoint’s attribution rests on several indicators: the infrastructure overlaps with a covert VPS network previously tied to multiple China‑aligned actors; early phishing emails contain Chinese‑language artifacts; and the tactic of compromising internet‑facing mail servers as a foothold for internal network infiltration mirrors known Chinese cyber‑espionage playbooks.

Mitigation Recommendations

Administrators are urged to apply the latest Roundcube patches that remediate both CVE‑2024‑42009 and CVE‑2025‑49113. Mail servers should be treated with the same rigor as VPN gateways—enforcing strict access controls, multi‑factor authentication, regular penetration testing, and continuous monitoring. Deploying sandboxing for inbound email attachments and blocking unknown domains can further reduce the attack surface.

Broader Implications

If left unchecked, such targeted intrusions could jeopardize sensitive national‑security research, intellectual property, and collaborative scientific projects. The incident underscores how legacy webmail platforms can become the weakest link in sophisticated espionage chains, urging institutions to adopt a holistic, zero‑trust approach to email security.