UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers

Key facts

Detection coverage

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1162 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: sslip.io / VShell C2 Beacon and Credential Exfiltration from Roundcube Host

Detects outbound beaconing from the Roundcube application server to sslip.io wildcard-DNS C2 endpoints on non-standard port 23088 (IceCube stealer), the VShell backdoor download/C2 path over /slw:8080, and bulk Roundcube server-side session destruction indicative of post-exploitation forensic evasion and session/credential exfiltration.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1571, T1090, T1539, T1041
• Data sources: proxy_logs, firewall_logs, DeviceNetworkEvents, roundcube_session_audit
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="proxy" OR sourcetype="firewall"
| eval sslip_hit=if(match(dest_host, "\.sslip\.io$") AND dest_port=23088, 1, 0)
| eval vshell_hit=if(match(url, "/slw:8080") OR dest_ip IN ("45.150.109.151","194.213.18.133","45.86.229.111"), 1, 0)
| where sslip_hit=1 OR vshell_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as hosts values(dest_ip) as ips by src_ip sslip_hit vshell_hit
| append [ search index=roundcube_audit sourcetype="roundcube_session" action="session_destroy"
| bucket _time span=5m
| stats count as session_kill_count by _time src_ip
| where session_kill_count > 5 ]
| sort -_time

Microsoft KQL

let c2ips = dynamic(["45.150.109.151", "194.213.18.133", "45.86.229.111"]);
let lookback = 24h;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where (RemoteUrl has "sslip.io" and RemotePort == 23088)
    or (RemoteUrl has "/slw:8080")
    or RemoteIP in (c2ips)
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| summarize BeaconCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl

Sigma

title: Roundcube Host Beaconing to sslip.io / VShell C2 Infrastructure
id: 9a0b1c2d-4e5f-4081-9b0c-2d3e4f506172
status: experimental
description: Detects outbound network connections from a Roundcube webmail server to sslip.io wildcard-DNS C2 endpoints on port 23088 (IceCube stealer disguised jQuery fetch) or the VShell backdoor /slw:8080 download/C2 path, and known UNK_MassTraction C2 IPs
references:
    - https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation
    - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
author: Threadlinqs Team
date: 2026-07-10
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.credential_access
    - attack.t1071.001
    - attack.t1571
    - attack.t1090
    - attack.t1539
    - attack.t1041
    - attack.tool.vshell
logsource:
    category: network_connection
    product: linux
detection:
    selection_sslip:
        DestinationHostname|endswith: '.sslip.io'
        DestinationPort: 23088
    selection_vshell_path:
        DestinationUrl|contains: '/slw:8080'
    selection_c2_ip:
        DestinationIp:
            - '45.150.109.151'
            - '194.213.18.133'
            - '45.86.229.111'
    condition: selection_sslip or selection_vshell_path or selection_c2_ip
falsepositives:
    - Legitimate use of sslip.io for internal testing/dev-ops purposes unrelated to this campaign
level: critical

Known false positives:

• Legitimate internal use of sslip.io for dev/test wildcard DNS resolution unrelated to this campaign
• Bulk session invalidation caused by a legitimate password-reset campaign or SSO re-enrollment event

Tuning notes: Maintain a rolling threat-intel feed of UNK_MassTraction C2 IPs/domains and refresh the sslip.io/VShell path indicators regularly since attacker infrastructure rotates; correlate session-destruction spikes with absence of a corresponding admin password-reset ticket before alerting.

• 🔒 Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) · unlock with TL Creds
• 🔒 Timestomped Webshell Drop Under Roundcube Plugin Directory (SquareShell) · unlock with TL Creds
• 🔒 sslip.io / VShell C2 Beacon and Credential Exfiltration from Roundcube Host · unlock with TL Creds
• 🔒 Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) · unlock with TL Creds
• 🔒 Process Masquerading as kworker Thread Spawned via nohup (SNOWLIGHT Fallback Loader) · unlock with TL Creds
• 🔒 IceCube Session/Credential Exfiltration and Bulk Roundcube Session Destruction · unlock with TL Creds
• 🔒 Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) · unlock with TL Creds
• 🔒 Timestomped Webshell Drop Under Roundcube Plugin Directory (SquareShell) · unlock with TL Creds

Indicators of compromise

As of 2026-07-10, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-1162.

Sample indicators (3 of 24)

• IP address: 45.150.109[.]151
• Domain: newfield[.]cl
• File hash: a02f124c5ce4180bd130a62ee03262f399c33491de3aed36e0b15155ae4926c0

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

Technical analysis

UNK_MassTraction is a low-volume, espionage-motivated threat cluster first documented by Proofpoint in July 2026 ('One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation'). The actor pre-screens internet-facing Roundcube Webmail servers for vulnerability to two n-day flaws before launching each intrusion, treating the mailserver itself as an edge device to be pivoted from rather than merely a mail platform to be abused.

The attack begins with a spearphishing email sent from compromised or spoofed sender accounts (domains with weak DMARC enforcement) to physics, engineering, and astrophysics/particle-physics researchers at U.S. and Canadian universities. The email body contains crafted HTML exploiting CVE-2024-42009, a stored XSS vulnerability in Roundcube's program/actions/mail/show.php message_body() rendering function, using an onanimationstart-triggered JavaScript payload to bypass Roundcube's HTML sanitizer. No authentication is required by the attacker and only minimal victim interaction (opening the email) is needed.

Once triggered, a JavaScript loader referred to as the IceCube stealer executes inside the victim's authenticated Roundcube session. IceCube first escapes Roundcube's iFrame sandbox via DOM traversal, gaining access to the full page DOM and the authenticated webmail session. It then harvests usernames, passwords, session cookies, and 2FA material, and performs browser reconnaissance (language, screen dimensions, form field values), exfiltrating everything via HTTP POST to attacker infrastructure. The stealer's code is heavily and unusually verbosely commented, which Proofpoint assesses is suggestive of LLM-assisted development. IceCube additionally implements anti-duplication checks, local-storage cleanup, and deferred exfiltration triggers (page close, tab switch, mouse-exit, logout-button hijack) to maximize collection while minimizing forensic footprint.

In parallel or as a follow-on, the actor exploits CVE-2025-49113, a critical PHP object deserialization vulnerability in program/actions/settings/upload.php caused by inadequate validation of the _from parameter. The exploit abuses Roundcube's use of PHP's native deserializer, which instantiates arbitrary classes found in a serialized blob, chaining through the Crypt_GPG_Engine class so that its __destruct() magic method passes attacker-controlled data via a _gpgconf argument into a shell execution sink. This grants authenticated (and in observed exploitation, effectively pre-authenticated via session hijack from the IceCube stage) remote code execution on the mailserver itself.

With server-side RCE, the actor drops a PHP webshell (SquareShell) at plugins/newmail_notifier/mail_preview.php — a path deliberately chosen to blend in with legitimate Roundcube plugin files — and timestomps the file so its modification time matches a genuine plugin, hindering incident-response triage. SquareShell exposes system, passthru, exec, shell_exec, assert, and popen execution primitives for follow-on RCE. If webshell deployment fails, the actor falls back to a bash loader script that sets PATH, fingerprints target CPU architecture, fetches an ELF loader payload from C2, and launches it via nohup with the process disguised as [kworker/0:2]; a lockfile at /tmp/log_de.log prevents re-infection. This loader is consistent with SNOWLIGHT, an ELF downloader publicly documented by Google Threat Intelligence and previously associated with the China-nexus cluster UNC5174, which in turn fetches and loads VShell — a Go-based, cross-platform (Linux/macOS/Windows) remote administration/backdoor tool offering an interactive shell and SOCKS-style port forwarding for internal network pivoting, loaded fully in-memory via fexecve() to minimize disk artifacts.

Operators additionally destroy Roundcube server-side sessions post-exploitation to remove forensic evidence, and the overall toolkit and TTPs (webshell timestomping, in-memory Go backdoor loading, SNOWLIGHT/VShell pairing) closely track prior UNC5174 activity. Proofpoint assesses UNK_MassTraction as likely China-aligned with low-to-moderate confidence based on shared covert VPS infrastructure, Chinese-language artifacts in early-campaign phishing HTML, VShell/SNOWLIGHT tooling overlap with known Chinese threat actors, and the strategic, narrowly-scoped targeting of academic institutions conducting national-security-relevant physics and engineering research.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.003 Web Portal Capture

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Credential Access

T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566.002 Spearphishing Link

Lateral Movement

T1210 Exploitation of Remote Services

impact

T1499.004 Application or System Exploitation

Persistence

T1505.003 Web Shell; T1554 Compromise Host Software Binary

Impact

T1531 Account Access Removal

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• Roundcube 1.6.8 / 1.5.8 (fixes CVE-2024-42009)
• Roundcube 1.6.11 / 1.5.10 (fixes CVE-2025-49113)

Immediate actions

• Patch Roundcube Webmail to 1.6.8/1.5.8 or later to remediate CVE-2024-42009
• Patch Roundcube Webmail to 1.6.11/1.5.10 or later to remediate CVE-2025-49113
• Audit plugins/ directory (especially newmail_notifier) for unexpected or timestomped PHP files
• Search webserver logs for POST requests to program/actions/settings/upload.php with anomalous _from parameters
• Terminate all active Roundcube sessions and force password/2FA re-enrollment for affected users
• Block known C2 IPs (45.150.109.151, 194.213.18.133, 45.86.229.111) and associated sslip.io subdomains at the perimeter

Workarounds

• Disable HTML rendering of untrusted email content where feasible
• Restrict Roundcube administrative/upload endpoints via WAF rules pending patch deployment

Longer-term hardening

• Deploy EDR with behavioral detection on Roundcube application servers to catch webshell and in-memory ELF/Go backdoor execution
• Implement DMARC enforcement (p=reject) to reduce spoofed-sender phishing delivery
• Monitor outbound connections from mail infrastructure for beaconing to sslip.io / dynamic-DNS-style wildcard domains
• Establish a vulnerability management SLA for internet-facing webmail to close the n-day exploitation window UNK_MassTraction relies on
• Deploy file-integrity monitoring on Roundcube plugin directories to detect timestomped webshells

Affected and fixed versions

• Roundcube — Roundcube Webmail
  Vulnerable versions: up to 1.5.7; 1.6.0 through 1.6.7
  Fixed in: 1.5.8; 1.6.8
• Roundcube — Roundcube Webmail
  Vulnerable versions: before 1.5.10; 1.6.0 through 1.6.10
  Fixed in: 1.5.10; 1.6.11

Timeline

• 2024-08-06 CVE-2024-42009 (Roundcube stored XSS) publicly disclosed and patched in Roundcube 1.5.8/1.6.8
• 2024-08-07 Sonar publishes 'Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail,' detailing the show.php message_body() sanitizer bypass later reused by UNK_MassTraction
• 2025-04-25 The Hacker News reports Chinese state-linked actors (UNC5174) targeting Linux systems with the SNOWLIGHT ELF downloader and VShell backdoor, establishing the tooling lineage UNK_MassTraction later reuses
• 2025-05-01 Sysdig publishes 'UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to VShell,' documenting the SNOWLIGHT-loader-to-VShell-backdoor pairing and in-memory fexecve() loading technique
• 2025-06-02 CVE-2025-49113 (Roundcube PHP object deserialization RCE) discovered by Kirill Firsov (FearsOff), after existing unnoticed in the codebase for roughly a decade
• 2025-06-09 CVE-2025-49113 publicly disclosed and patched in Roundcube 1.5.10/1.6.11; added to CISA KEV catalog
• 2026-05-01 UNK_MassTraction campaign begins; Proofpoint observes exploitation of CVE-2024-42009 against university Roundcube servers
• 2026-06-01 Fallback VShell in-memory backdoor deployment introduced into the campaign alongside SquareShell webshell installs; C2 activity observed on locked-ioc-10 and locked-ioc-11
• 2026-07-08 Proofpoint publishes 'One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation,' detailing the campaign; picked up by BleepingComputer, The Hacker News, The Register, and other outlets
• 2026-07-10 Threat ingested and researched by Threadlinqs Intelligence Platform

Sources cited

Showing 15 of 16 sources, primary sources first.

• CVE-2024-42009 Details - NVD NVD (NIST) · Advisory · 2024-08-06
• CVE-2025-49113 Details - NVD NVD (NIST) · Advisory · 2025-06-09
• One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation Proofpoint · Vendor report · 2026-07-08
• Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail sonarsource.com · Research · 2024-08-07
• Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization [CVE-2025-49113] fearsoff.org · Research · 2025-06-02
• CVE-2025-49113: Post-Auth Remote Code Execution in Roundcube via PHP Object Deserialization offsec.com · Research · 2025-06-09
• UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to VShell sysdig.com · Research · 2025-05-01
• The Silent, Fileless Threat of VShell trellix.com · Research · 2025-06-01
• Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization GitHub · Code repository · 2025-06-09
• Hackers exploit Roundcube flaw to spy on academic researchers BleepingComputer · News · 2026-07-08
• Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities The Hacker News · News · 2026-07-08
• Suspected Chinese snoops caught breaking into universities' Roundcube mailservers The Register · News · 2026-07-08
• Hackers Exploit Roundcube N-Day Flaws to Steal Credentials and Deploy VShell cybersecuritynews.com · News · 2026-07-08
• China-Aligned UNK_MassTraction Exploits Roundcube Servers to Target Universities gbhackers.com · News · 2026-07-08
• Suspected Chinese Threat Group Targets Universities infosecurity-magazine.com · News · 2026-07-08

Related threats

• RoundCube Webmail Active Exploitation — CVE-2025-49113 Deserialization RCE (CVSS 9.9) + CVE-2025-68461 XSS via SVG Animate Tag (CISA KEV)
• WP-SHELLSTORM: Exposed Chinese-Speaking Threat Actor Server Reveals Mass WordPress/Joomla Webshell Brokerage Targeting 1.4M Domains via CVE-2026-48907 (Joomla JCE) and CVE-2021-29441 (Nacos)

Other reports on CVE-2024-42009

• Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)

Other reports on CVE-2025-49113

• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry
• Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)

Previous and next in vulnerability

• CVE-2026-50746: Critical Unauthenticated Command Injection in Ubiquiti UniFi Connect Application (CVSS 10.0) Previous report
• HalluSquatting: AI Coding Assistant Hallucinations Weaponized to Deliver Botnet Malware via Fake Package/Tool/Skill Names Next report