A suspected China-aligned threat group has been actively exploiting critical Roundcube webmail vulnerabilities against US and Canadian universities in a sophisticated espionage campaign. Security researchers at Proofpoint uncovered the operation, tracked as UNK_MassTraction, which uses a Roundcube zero-click XSS exploit chain to steal credentials, deploy backdoors, and maintain persistent access to academic networks.

The campaign targets physics and engineering departments at universities involved in astrophysics, particle physics, and national security-related research. Administrators, professors, and researchers have all been in the crosshairs since May 2026.

Roundcube Zero-Click XSS Vulnerability Details

The attack chain exploits two now-patched Roundcube vulnerabilities in sequence:

CVE-2024-42009 (CVSS 9.3): A cross-site scripting (XSS) flaw that triggers automatically when a victim opens a malicious email in a vulnerable Roundcube client. No user interaction beyond opening the email is required, making it a zero-click exploit vector.

CVE-2025-49113 (CVSS 9.9): A post-authenticated deserialization flaw that provides remote code execution. After the XSS exploit harvests the victim's session token, IceCube uses the CSRF token to weaponize this second flaw and gain a foothold on the mail server.

Additionally, Roundcube 1.7.2 released on July 10, 2026, addresses two newly disclosed vulnerabilities:

• CVE-2026-54433: A zero-click stored XSS in plain-text rendering that triggers without any email interaction
• CVE-2026-54432: Stored XSS via unescaped attachment MIME type on the attachment-validation warning page
• SSRF bypass via specific local address URLs (two new cases)
• DoS via crafted compressed-RTF size in TNEF (winmail.dat) files
• Infinite loop in the TNEF decoder

The new CVEs make it clear that webmail platforms remain a persistent attack surface even after the older flaws were addressed.

The UNK_MassTraction Attack Chain

Proofpoint's technical analysis reveals a multi-stage infection chain:

Stage 1: Reconnaissance. The threat actor first scans for Roundcube servers running unpatched versions susceptible to CVE-2024-42009 and CVE-2025-49113. This pre-attack recon indicates a deliberate, targeted approach rather than opportunistic scanning.

Stage 2: Delivery. A spear-phishing email with a generic lure is sent from compromised accounts or spoofed domains with weak DMARC policies. The generic nature of the lures suggests the targeting swath may be broader than what has been observed so far.

Stage 3: IceCube Deployment. Simply opening the email triggers CVE-2024-42009, executing JavaScript in the victim's browser. This loads a payload called IceCube, a fully featured Roundcube credential stealer that harvests usernames, passwords, cookies, 2FA tokens, and browser information.

IceCube is notably sophisticated. It sets up 'deferred triggers' that monitor user behavior: if the user closes the page, changes tabs, or clicks the logout button, IceCube re-attempts exploitation of CVE-2025-49113 and beacons to the command-and-control server. These triggers ensure the infection chain continues even if the user walks away mid-session.

Stage 4: Server Compromise. Using the harvested CSRF token, IceCube exploits CVE-2025-49113 to achieve remote code execution on the mail server. It then drops one of two payloads:

• SquareShell: A PHP webshell deployed at plugins/newmail_notifier/mail_preview.php that gives the attacker full remote code execution
• VShell: A Go-based backdoor supporting interactive shell access and port forwarding, loaded directly in memory

If SquareShell deployment fails, a fallback mechanism introduced in June 2026 uses a shell script to deliver Snowlight, an ELF loader that provides post-compromise capabilities similar to Cobalt Strike.

Stage 5: Cleanup. IceCube destroys both user and malware-initiated sessions on the server when it finishes, forcing a logout and erasing forensic evidence of the compromise from the Roundcube server logs.

Why This Matters to Developers

Webmail servers are often treated as lower-priority assets compared to VPNs or production infrastructure. This campaign proves that approach is dangerous.

If your organization runs Roundcube, you are a potential entry point for adversaries who will use the mail server as a pivot into your internal network. The UNK_MassTraction campaign demonstrates that Chinese-aligned actors actively scan for exposed Roundcube instances and have mature tooling to exploit them.

The use of N-day vulnerabilities (CVEs from 2024 and 2025 that should have been patched long ago) highlights a critical reality: attackers succeed not because their exploits are novel, but because patches go unapplied.

Mitigation Steps

1. Update immediately. Upgrade to Roundcube 1.7.2 or 1.6.17, which patch all known vulnerabilities including CVE-2026-54432, CVE-2026-54433, and the SSRF bypasses
2. Treat webmail as an edge device. Apply the same patching diligence to mail servers as you do to VPN concentrators and remote access gateways
3. Enforce DMARC. Weak DMARC policies enabled spoofed sender addresses in this campaign. Implement a strict DMARC rejection policy
4. Monitor for IceCube indicators. Watch for suspicious HTTP POST requests from Roundcube sessions, unexpected PHP files under plugins/newmail_notifier/, and unusual outbound connections from mail servers
5. Audit access logs. Review Roundcube access logs for the reconnaissance patterns UNK_MassTraction uses to identify vulnerable targets

Frequently Asked Questions

Q: Was my Roundcube instance affected? A: If you are running Roundcube 1.7.1 or earlier, you are vulnerable. Check your version in the Roundcube About page and upgrade to 1.7.2 immediately.

Q: How do I know if I have been compromised? A: Look for unexpected PHP files in the Roundcube plugins directory, especially under plugins/newmail_notifier/. Check for unusual outbound connections from the mail server and review web server logs for POST requests to suspicious endpoints.

Q: Is this the same as the earlier Roundcube XSS vulnerabilities? A: The UNK_MassTraction campaign exploits CVE-2024-42009 and CVE-2025-49113, which are older flaws. However, Roundcube 1.7.2 also fixes new vulnerabilities including CVE-2026-54433, a zero-click stored XSS that was disclosed separately.

Q: Do hosted email providers use Roundcube? A: Many web hosting control panels and email hosting providers bundle Roundcube as the default webmail client. Check with your provider about which version they are running.

Q: What should I do if I find evidence of compromise? A: Isolate the mail server immediately, preserve logs and disk images for forensic analysis, and engage your incident response team. Change all credentials that may have passed through the compromised webmail interface.

Key Takeaways

• Chinese-aligned UNK_MassTraction group exploits Roundcube XSS and RCE flaws against universities
• The IceCube malware autonomously harvests credentials, deploys backdoors, and erases forensic evidence
• Roundcube 1.7.2 patches CVE-2026-54432, CVE-2026-54433, SSRF bypasses, and DoS vectors
• Webmail servers must be patched with the same urgency as VPNs and firewalls
• DMARC enforcement and access log auditing are critical defensive measures

Conclusion

The UNK_MassTraction campaign is a wake-up call for every organization running webmail. Attackers are actively weaponizing both old and newly disclosed vulnerabilities against high-value academic targets, and they have developed sophisticated tooling to evade detection and persist on compromised servers.

The fix is simple: patch Roundcube to 1.7.2 today. But the broader lesson is that webmail infrastructure deserves the same security rigor as any other edge service. In an era where email remains the primary vector for both phishing and direct compromise, treating mail servers as second-class assets is no longer acceptable.

---

Sources: BleepingComputer, The Hacker News, Proofpoint, Roundcube GitHub