China-linked crew hits unpatched Roundcube to spy on physicists

A suspected China-aligned espionage group has spent the past few months quietly working its way through the inboxes of physics and engineering researchers at universities across the US and Canada. Proofpoint, which is tracking the activity as UNK_MassTraction, says the campaign has been running since May and shows a clear appetite for astrophysics, particle physics and anything that touches national security research.

The way in is Roundcube, the open-source webmail client that plenty of universities still run. Victims get a fairly generic lure email, and simply opening it inside a vulnerable Roundcube instance is enough to trigger CVE-2024-42009, a cross-site scripting flaw that runs attacker JavaScript inside the browser.

What the payload actually does

That JavaScript pulls down a stealer Proofpoint calls IceCube. It hoovers up the obvious things: usernames, passwords, cookies, browser data, and two-factor authentication tokens. For an espionage operator interested in unpublished research and internal correspondence, an academic mailbox is a very rich seam.

From there the attackers try to escalate. IceCube carries helpers that exploit a second Roundcube bug, CVE-2025-49113, to drop a PHP webshell called SquareShell on the mail server itself. If that step fails, the malware falls back to loading VShell, a Go-based backdoor that has become a favourite of Chinese operators, straight into memory so it never touches disk.

The homework is the interesting bit

Plenty of espionage campaigns spray and pray. This one didn't. Proofpoint reckons UNK_MassTraction went looking for Roundcube servers already known to be vulnerable to those two CVEs before firing off any lure emails. Targets were selected because someone had already checked their mail server was reachable and unpatched.

That's worth sitting with for a moment. It means an exposed webmail instance with pending updates isn't just a housekeeping problem to get around to next sprint. It's a live entry on somebody's target spreadsheet, waiting for a quiet week when the operator has time to work through the list.

Why universities keep ending up here

Academic IT sits in an awkward spot. Budgets are tight, self-hosted open-source stacks are common, and the userbase (researchers, postgrads, visiting fellows) is famously resistant to anything that looks like a security control getting in the way of the work. Roundcube fits that world neatly, which is exactly why it keeps showing up as an initial access vector.

The kicker with this campaign is that no user did anything wrong. There's no dodgy attachment to open, no credential prompt to click through. The exploit fires on preview. The only defence is a patched server.

• Patches for both CVEs have been out for months.
• The stealer targets session cookies and 2FA tokens, so password rotation alone won't clear a compromise.
• Any Roundcube instance exposed to the internet should be treated with the same seriousness as a VPN gateway, because functionally, that's what it is.

The researchers being targeted here work on the kind of physics that ends up in export-control conversations. Someone has decided their inboxes are worth a bespoke exploit chain. The universities hosting those inboxes get to decide whether the mail server is worth a Tuesday afternoon of patching.