UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers — Threadlinqs Intelligence
As of 2026-07-10, UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers is a high-severity vulnerability threat attributed to UNK_MassTraction (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1162 · Severity: HIGH · CVSS: 9.9 · Status: ACTIVE · Category: VULNERABILITY
Attribution: UNK_MassTraction · China · ESPIONAGE
A suspected China-aligned threat cluster tracked as UNK_MassTraction has been actively exploiting Roundcube webmail vulnerabilities CVE-2024-42009 (XSS) and CVE-2025-49113 (PHP object deserialization)
UNK_MassTraction is a low-volume, espionage-motivated threat cluster first documented by Proofpoint in July 2026 ('One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation'). The actor pre-screens internet-facing Roundcube Webmail servers for vulnerability to two n-day flaws before launching each intrusion, treating the mailserver itself as an edge device to be pivoted from rather than merely a mail platform to be abused.
The attack begins with a spearphishing email sent from compromised or spoofed sender accounts (domains with weak DMARC enforcement) to physics, engineering, and astrophysics/particle-physics researchers at U.S. and Canadian universities. The email body contains crafted HTML exploiting CVE-2024-42009, a stored XSS vulnerability in Roundcube's program/actions/mail/show.php message_body() rendering function, using an onanimationstart-triggered JavaScript payload to bypass Roundcube's HTML sanitizer. No authentication is required by the attacker and only minimal victim interaction (opening the email) is needed.
Once triggered, a JavaScript loader referred to as the IceCube stealer executes inside the victim's authenticated Roundcube session. IceCube first escapes Roundcube's iFrame sandbox via DOM traversal, gaining access to the full page DOM and the authenticated webmail session. It then harvests usernames, passwords, session cookies, and 2FA material, and performs browser reconnaissance (language, screen dimensions, form field values), exfiltrating everything via HTTP POST to attacker infrastructure. The stealer's code is heavily and unusually verbosely commented, which Proofpoint assesses is suggestive of LLM-assisted development. IceCube additionally implements anti-duplication checks, local-storage cleanup, and deferred exfiltration triggers (page close, tab switch, mouse-exit, logout-button hijack) to maximize collection while minimizing forensic footprint.
In parallel or as a follow-on, the actor exploits CVE-2025-49113, a critical PHP object deserialization vulnerability in program/actions/settings/upload.php caused by inadequate validation of the _from parameter. The exploit abuses Roundcube's use of PHP's native deserializer, which instantiates arbitrary classes found in a serialized blob, chaining through the Crypt_GPG_Engine class so that its __destruct() magic method passes attacker-controlled data via a _gpgconf argument into a shell execution sink. This grants authenticated (and in observed exploitation, effectively pre-authenticated via session hijack from the IceCube stage) remote code execution on the mailserver itself.
With server-side RCE, the actor drops a PHP webshell (SquareShell) at plugins/newmail_notifier/mail_preview.php — a path deliberately chosen to blend in with legitimate Roundcube plugin files — and timestomps the file so its modification time matches a genuine plugin, hindering incident-response triage. SquareShell exposes system, passthru, exec, shell_exec, assert, and popen execution primitives for follow-on RCE. If webshell deployment fails, the actor falls back to a bash loader script that sets PATH, fingerprints target CPU architecture, fetches an ELF loader payload from C2, and launches it via nohup with the process disguised as [kworker/0:2]; a lockfile at /tmp/log_de.log prevents re-infection. This loader is consistent with SNOWLIGHT, an ELF downloader publicly documented by Google Threat Intelligence and previously associated with the China-nexus cluster UNC5174, which in turn fetches and loads VShell — a Go-based, cross-platform (Linux/macOS/Windows) remote administration/backdoor tool offering an interactive shell and SOCKS-style port forwarding for internal network pivoting, loaded fully in-memory via fexecve() to minimize disk artifacts.
Operators additionally destroy Roundcube server-side sessions post-exploitation to remove forensic evidence, and the overall toolkit and TTPs (webshell timestomping, in-memory Go backdoor loading, SNOWLIGHT/
Weaknesses (CWE)
CWE-79, CWE-502
Target sectors: academic research, education, government administration
Target regions: North America
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2024-42009, CVE-2025-49113, T1595, T1566.002, T1190, T1199, T1059.007, T1059.004, T1204.001, T1499.004, T1505.003, T1554