UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers

UNK_MassTraction Exploits Roundcube XSS/Deserialization (TL-2026-1162), also tracked as One Email Closer to the Edge, is a high-severity software vulnerability scored CVSS 9.9, first published 2026-07-10. It is attributed to UNK_MassTraction (China) with low confidence, affects Roundcube Roundcube Webmail, references 2 CVEs (CVE-2024-42009, CVE-2025-49113), maps to 29 MITRE ATT&CK techniques (T1005, T1036.005, T1041), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1162

Threat ID
TL-2026-1162
Also known as
One Email Closer to the Edge
Severity
HIGH
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-10
Last reviewed
2026-07-10
Attribution
UNK_MassTraction
Attribution confidence
LOW
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
academic research, education, government administration
Target regions
North America
Detection rules
9
Indicators of compromise
24

Malware and tooling in UNK_MassTraction Exploits Roundcube XSS/Deserialization

Malware and tooling: IceCube, SNOWLIGHT, SquareShell, VShell, Covert China-aligned VPS infrastructure, VShell

A suspected China-aligned threat cluster tracked as UNK_MassTraction has been actively exploiting Roundcube webmail vulnerabilities CVE-2024-42009 (XSS) and CVE-2025-49113 (PHP object deserialization) since May 2026 to target physics and engineering departments at U.S. and Canadian universities. Phishing emails trigger the XSS flaw to deliver an IceCube stealer payload that harvests credentials and 2FA data, then chain into the deserialization bug to install a SquareShell webshell or Go-based VShell backdoor.

How UNK_MassTraction Exploits Roundcube XSS/Deserialization works

UNK_MassTraction is a low-volume, espionage-motivated threat cluster first documented by Proofpoint in July 2026 ('One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation'). The actor pre-screens internet-facing Roundcube Webmail servers for vulnerability to two n-day flaws before launching each intrusion, treating the mailserver itself as an edge device to be pivoted from rather than merely a mail platform to be abused.

The attack begins with a spearphishing email sent from compromised or spoofed sender accounts (domains with weak DMARC enforcement) to physics, engineering, and astrophysics/particle-physics researchers at U.S. and Canadian universities. The email body contains crafted HTML exploiting CVE-2024-42009, a stored XSS vulnerability in Roundcube's program/actions/mail/show.php message_body() rendering function, using an onanimationstart-triggered JavaScript payload to bypass Roundcube's HTML sanitizer. No authentication is required by the attacker and only minimal victim interaction (opening the email) is needed.

Once triggered, a JavaScript loader referred to as the IceCube stealer executes inside the victim's authenticated Roundcube session. IceCube first escapes Roundcube's iFrame sandbox via DOM traversal, gaining access to the full page DOM and the authenticated webmail session. It then harvests usernames, passwords, session cookies, and 2FA material, and performs browser reconnaissance (language, screen dimensions, form field values), exfiltrating everything via HTTP POST to attacker infrastructure. The stealer's code is heavily and unusually verbosely commented, which Proofpoint assesses is suggestive of LLM-assisted development. IceCube additionally implements anti-duplication checks, local-storage cleanup, and deferred exfiltration triggers (page close, tab switch, mouse-exit, logout-button hijack) to maximize collection while minimizing forensic footprint.

In parallel or as a follow-on, the actor exploits CVE-2025-49113, a critical PHP object deserialization vulnerability in program/actions/settings/upload.php caused by inadequate validation of the _from parameter. The exploit abuses Roundcube's use of PHP's native deserializer, which instantiates arbitrary classes found in a serialized blob, chaining through the Crypt_GPG_Engine class so that its __destruct() magic method passes attacker-controlled data via a _gpgconf argument into a shell execution sink. This grants authenticated (and in observed exploitation, effectively pre-authenticated via session hijack from the IceCube stage) remote code execution on the mailserver itself.

With server-side RCE, the actor drops a PHP webshell (SquareShell) at plugins/newmail_notifier/mail_preview.php — a path deliberately chosen to blend in with legitimate Roundcube plugin files — and timestomps the file so its modification time matches a genuine plugin, hindering incident-response triage. SquareShell exposes system, passthru, exec, shell_exec, assert, and popen execution primitives for follow-on RCE. If webshell deployment fails, the actor falls back to a bash loader script that sets PATH, fingerprints target CPU architecture, fetches an ELF loader payload from C2, and launches it via nohup with the process disguised as [kworker/0:2]; a lockfile at /tmp/log_de.log prevents re-infection. This loader is consistent with SNOWLIGHT, an ELF downloader publicly documented by Google Threat Intelligence and previously associated with the China-nexus cluster UNC5174, which in turn fetches and loads VShell — a Go-based, cross-platform (Linux/macOS/Windows) remote administration/backdoor tool offering an interactive shell and SOCKS-style port forwarding for internal network pivoting, loaded fully in-memory via fexecve() to minimize disk artifacts.

Operators additionally destroy Roundcube server-side sessions post-exploitation to remove forensic evidence, and the overall toolkit and TTPs (webshell timestomping, in-memory Go backdoor loading, SNOWLIGHT/VShell pairing) closely track prior UNC5174 activity. Proofpoint assesses UNK_MassTraction as likely China-aligned with low-to-moderate confidence based on shared covert VPS infrastructure, Chinese-language artifacts in early-campaign phishing HTML, VShell/SNOWLIGHT tooling overlap with known Chinese threat actors, and the strategic, narrowly-scoped targeting of academic institutions conducting national-security-relevant physics and engineering research.

MITRE ATT&CK techniques used in TL-2026-1162

Collection

T1005 Data from Local System; T1056.003 Web Portal Capture

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566.002 Spearphishing Link

Lateral Movement

T1210 Exploitation of Remote Services

impact

T1499.004 Application or System Exploitation

Persistence

T1505.003 Web Shell; T1554 Compromise Host Software Binary

Impact

T1531 Account Access Removal

Reconnaissance

T1595 Active Scanning

Affected products and versions in UNK_MassTraction Exploits Roundcube XSS/Deserialization

  • Roundcube — Roundcube Webmail
    Vulnerable versions: up to 1.5.7; 1.6.0 through 1.6.7
    Fixed in: 1.5.8; 1.6.8
  • Roundcube — Roundcube Webmail
    Vulnerable versions: before 1.5.10; 1.6.0 through 1.6.10
    Fixed in: 1.5.10; 1.6.11

Remediation for UNK_MassTraction Exploits Roundcube XSS/Deserialization

Patches

  • Roundcube 1.6.8 / 1.5.8 (fixes CVE-2024-42009)
  • Roundcube 1.6.11 / 1.5.10 (fixes CVE-2025-49113)

Immediate actions

  • Patch Roundcube Webmail to 1.6.8/1.5.8 or later to remediate CVE-2024-42009
  • Patch Roundcube Webmail to 1.6.11/1.5.10 or later to remediate CVE-2025-49113
  • Audit plugins/ directory (especially newmail_notifier) for unexpected or timestomped PHP files
  • Search webserver logs for POST requests to program/actions/settings/upload.php with anomalous _from parameters
  • Terminate all active Roundcube sessions and force password/2FA re-enrollment for affected users
  • Block known C2 IPs (45.150.109.151, 194.213.18.133, 45.86.229.111) and associated sslip.io subdomains at the perimeter

Workarounds

  • Disable HTML rendering of untrusted email content where feasible
  • Restrict Roundcube administrative/upload endpoints via WAF rules pending patch deployment

Longer-term hardening

  • Deploy EDR with behavioral detection on Roundcube application servers to catch webshell and in-memory ELF/Go backdoor execution
  • Implement DMARC enforcement (p=reject) to reduce spoofed-sender phishing delivery
  • Monitor outbound connections from mail infrastructure for beaconing to sslip.io / dynamic-DNS-style wildcard domains
  • Establish a vulnerability management SLA for internet-facing webmail to close the n-day exploitation window UNK_MassTraction relies on
  • Deploy file-integrity monitoring on Roundcube plugin directories to detect timestomped webshells

CVEs associated with UNK_MassTraction Exploits Roundcube XSS/Deserialization

CVE-2024-42009, CVE-2025-49113

Weaknesses (CWE) in UNK_MassTraction Exploits Roundcube XSS/Deserialization

CWE-79, CWE-502

Timeline of UNK_MassTraction Exploits Roundcube XSS/Deserialization

  • CVE-2024-42009 (Roundcube stored XSS) publicly disclosed and patched in Roundcube 1.5.8/1.6.8
  • Sonar publishes 'Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail,' detailing the show.php message_body() sanitizer bypass later reused by UNK_MassTraction
  • The Hacker News reports Chinese state-linked actors (UNC5174) targeting Linux systems with the SNOWLIGHT ELF downloader and VShell backdoor, establishing the tooling lineage UNK_MassTraction later reuses
  • Sysdig publishes 'UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to VShell,' documenting the SNOWLIGHT-loader-to-VShell-backdoor pairing and in-memory fexecve() loading technique
  • CVE-2025-49113 (Roundcube PHP object deserialization RCE) discovered by Kirill Firsov (FearsOff), after existing unnoticed in the codebase for roughly a decade
  • CVE-2025-49113 publicly disclosed and patched in Roundcube 1.5.10/1.6.11; added to CISA KEV catalog
  • UNK_MassTraction campaign begins; Proofpoint observes exploitation of CVE-2024-42009 against university Roundcube servers
  • Fallback VShell in-memory backdoor deployment introduced into the campaign alongside SquareShell webshell installs; C2 activity observed on 194.213.18.133 and 45.86.229.111
  • Proofpoint publishes 'One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation,' detailing the campaign; picked up by BleepingComputer, The Hacker News, The Register, and other outlets
  • Threat ingested and researched by Threadlinqs Intelligence Platform

Sources cited for UNK_MassTraction Exploits Roundcube XSS/Deserialization

Threats related to UNK_MassTraction Exploits Roundcube XSS/Deserialization

Detection coverage for TL-2026-1162

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1162 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats