# UNK_MassTraction Exploits Roundcube XSS/Deserialization Flaws (CVE-2024-42009, CVE-2025-49113) to Spy on Academic Researchers

> A suspected China-aligned threat cluster tracked as UNK_MassTraction has been actively exploiting Roundcube webmail vulnerabilities CVE-2024-42009 (XSS) and CVE-2025-49113 (PHP object deserialization) since May 2026 to target physics and engineering departments at U.S. and Canadian universities. Phishing emails trigger the XSS flaw to deliver an IceCube stealer payload that harvests credentials and 2FA data, then chain into the deserialization bug to install a SquareShell webshell or Go-based VShell backdoor.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1162
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-roundcube-xss-academic-researcher-spying-tl-2026-1162.webp?v=faf7b5ff (Threadlinqs threat intel: CVE-2024-42009 Roundcube XSS IceCube: Detection & IOCs (TL-2026-1162) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-1162
- **Severity:** HIGH (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNK_MassTraction (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)
- **CVEs:** CVE-2024-42009, CVE-2025-49113

## Description

UNK_MassTraction is a low-volume, espionage-motivated threat cluster first documented by Proofpoint in July 2026 ('One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation'). The actor pre-screens internet-facing Roundcube Webmail servers for vulnerability to two n-day flaws before launching each intrusion, treating the mailserver itself as an edge device to be pivoted from rather than merely a mail platform to be abused.

The attack begins with a spearphishing email sent from compromised or spoofed sender accounts (domains with weak DMARC enforcement) to physics, engineering, and astrophysics/particle-physics researchers at U.S. and Canadian universities. The email body contains crafted HTML exploiting CVE-2024-42009, a stored XSS vulnerability in Roundcube's program/actions/mail/show.php message_body() rendering function, using an onanimationstart-triggered JavaScript payload to bypass Roundcube's HTML sanitizer. No authentication is required by the attacker and only minimal victim interaction (opening the email) is needed.

Once triggered, a JavaScript loader referred to as the IceCube stealer executes inside the victim's authenticated Roundcube session. IceCube first escapes Roundcube's iFrame sandbox via DOM traversal, gaining access to the full page DOM and the authenticated webmail session. It then harvests usernames, passwords, session cookies, and 2FA material, and performs browser reconnaissance (language, screen dimensions, form field values), exfiltrating everything via HTTP POST to attacker infrastructure. The stealer's code is heavily and unusually verbosely commented, which Proofpoint assesses is suggestive of LLM-assisted development. IceCube additionally implements anti-duplication checks, local-storage cleanup, and deferred exfiltration triggers (page close, tab switch, mouse-exit, logout-button hijack) to maximize collection while minimizing forensic footprint.

In parallel or as a follow-on, the actor exploits CVE-2025-49113, a critical PHP object deserialization vulnerability in program/actions/settings/upload.php caused by inadequate validation of the _from parameter. The exploit abuses Roundcube's use of PHP's native deserializer, which instantiates arbitrary classes found in a serialized blob, chaining through the Crypt_GPG_Engine class so that its __destruct() magic method passes attacker-controlled data via a _gpgconf argument into a shell execution sink. This grants authenticated (and in observed exploitation, effectively pre-authenticated via session hijack from the IceCube stage) remote code execution on the mailserver itself.

With server-side RCE, the actor drops a PHP webshell (SquareShell) at plugins/newmail_notifier/mail_preview.php — a path deliberately chosen to blend in with legitimate Roundcube plugin files — and timestomps the file so its modification time matches a genuine plugin, hindering incident-response triage. SquareShell exposes system, passthru, exec, shell_exec, assert, and popen execution primitives for follow-on RCE. If webshell deployment fails, the actor falls back to a bash loader script that sets PATH, fingerprints target CPU architecture, fetches an ELF loader payload from C2, and launches it via nohup with the process disguised as [kworker/0:2]; a lockfile at /tmp/log_de.log prevents re-infection. This loader is consistent with SNOWLIGHT, an ELF downloader publicly documented by Google Threat Intelligence and previously associated with the China-nexus cluster UNC5174, which in turn fetches and loads VShell — a Go-based, cross-platform (Linux/macOS/Windows) remote administration/backdoor tool offering an interactive shell and SOCKS-style port forwarding for internal network pivoting, loaded fully in-memory via fexecve() to minimize disk artifacts.

Operators additionally destroy Roundcube server-side sessions post-exploitation to remove forensic evidence, and the overall toolkit and TTPs (webshell timestomping, in-memory Go backdoor loading, SNOWLIGHT/VShell pairing) closely track prior UNC5174 activity. Proofpoint assesses UNK_MassTraction as likely China-aligned with low-to-moderate confidence based on shared covert VPS infrastructure, Chinese-language artifacts in early-campaign phishing HTML, VShell/SNOWLIGHT tooling overlap with known Chinese threat actors, and the strategic, narrowly-scoped targeting of academic institutions conducting national-security-relevant physics and engineering research.

## MITRE ATT&CK

- T1595 Active Scanning
- T1566.002 Spearphishing Link
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1204.001 Malicious Link
- T1499.004 Application or System Exploitation
- T1505.003 Web Shell
- T1554 Compromise Host Software Binary
- T1070.006 Timestomp
- T1070 Indicator Removal
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1111 Multi-Factor Authentication Interception
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1056.003 Web Portal Capture
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**sslip.io / VShell C2 Beacon and Credential Exfiltration from Roundcube Host** (`TL-2026-1162-SPL-003`)

Detects outbound beaconing from the Roundcube application server to sslip.io wildcard-DNS C2 endpoints on non-standard port 23088 (IceCube stealer), the VShell backdoor download/C2 path over /slw:8080, and bulk Roundcube server-side session destruction indicative of post-exploitation forensic evasion and session/credential exfiltration.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1571, T1090, T1539, T1041
- **Data sources:** proxy_logs, firewall_logs, DeviceNetworkEvents, roundcube_session_audit
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="proxy" OR sourcetype="firewall"
| eval sslip_hit=if(match(dest_host, "\.sslip\.io$") AND dest_port=23088, 1, 0)
| eval vshell_hit=if(match(url, "/slw:8080") OR dest_ip IN ("45.150.109.151","194.213.18.133","45.86.229.111"), 1, 0)
| where sslip_hit=1 OR vshell_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_host) as hosts values(dest_ip) as ips by src_ip sslip_hit vshell_hit
| append [ search index=roundcube_audit sourcetype="roundcube_session" action="session_destroy"
| bucket _time span=5m
| stats count as session_kill_count by _time src_ip
| where session_kill_count > 5 ]
| sort -_time
```

### Microsoft KQL

```kql
let c2ips = dynamic(["45.150.109.151", "194.213.18.133", "45.86.229.111"]);
let lookback = 24h;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where (RemoteUrl has "sslip.io" and RemotePort == 23088)
    or (RemoteUrl has "/slw:8080")
    or RemoteIP in (c2ips)
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| summarize BeaconCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl
```

### Sigma

```yaml
title: Roundcube Host Beaconing to sslip.io / VShell C2 Infrastructure
id: 9a0b1c2d-4e5f-4081-9b0c-2d3e4f506172
status: experimental
description: Detects outbound network connections from a Roundcube webmail server to sslip.io wildcard-DNS C2 endpoints on port 23088 (IceCube stealer disguised jQuery fetch) or the VShell backdoor /slw:8080 download/C2 path, and known UNK_MassTraction C2 IPs
references:
    - https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation
    - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
author: Threadlinqs Team
date: 2026-07-10
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.credential_access
    - attack.t1071.001
    - attack.t1571
    - attack.t1090
    - attack.t1539
    - attack.t1041
    - attack.tool.vshell
logsource:
    category: network_connection
    product: linux
detection:
    selection_sslip:
        DestinationHostname|endswith: '.sslip.io'
        DestinationPort: 23088
    selection_vshell_path:
        DestinationUrl|contains: '/slw:8080'
    selection_c2_ip:
        DestinationIp:
            - '45.150.109.151'
            - '194.213.18.133'
            - '45.86.229.111'
    condition: selection_sslip or selection_vshell_path or selection_c2_ip
falsepositives:
    - Legitimate use of sslip.io for internal testing/dev-ops purposes unrelated to this campaign
level: critical
```

**Known false positives:**

- Legitimate internal use of sslip.io for dev/test wildcard DNS resolution unrelated to this campaign
- Bulk session invalidation caused by a legitimate password-reset campaign or SSO re-enrollment event

**Tuning notes:** Maintain a rolling threat-intel feed of UNK_MassTraction C2 IPs/domains and refresh the sslip.io/VShell path indicators regularly since attacker infrastructure rotates; correlate session-destruction spikes with absence of a corresponding admin password-reset ticket before alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) (locked: unlock with TL Creds)
- Timestomped Webshell Drop Under Roundcube Plugin Directory (SquareShell) (locked: unlock with TL Creds)
- sslip.io / VShell C2 Beacon and Credential Exfiltration from Roundcube Host (locked: unlock with TL Creds)
- Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) (locked: unlock with TL Creds)
- Process Masquerading as kworker Thread Spawned via nohup (SNOWLIGHT Fallback Loader) (locked: unlock with TL Creds)
- IceCube Session/Credential Exfiltration and Bulk Roundcube Session Destruction (locked: unlock with TL Creds)
- Roundcube XSS/Deserialization Exploitation Chain (CVE-2024-42009 / CVE-2025-49113) (locked: unlock with TL Creds)
- Timestomped Webshell Drop Under Roundcube Plugin Directory (SquareShell) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `45.150.109[.]151`
- Domain: `newfield[.]cl`
- File hash: `a02f124c5ce4180bd130a62ee03262f399c33491de3aed36e0b15155ae4926c0`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers exploit Roundcube flaw to spy on academic researchers](https://www.bleepingcomputer.com/news/security/hackers-exploit-roundcube-flaw-to-spy-on-academic-researchers/)
- [One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation](https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation)
- [Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities](https://thehackernews.com/2026/07/suspected-china-aligned-hackers-exploit.html)
- [Suspected Chinese snoops caught breaking into universities' Roundcube mailservers](https://www.theregister.com/security/2026/07/08/suspected-chinese-snoops-caught-breaking-into-universities-roundcube-mailservers/5268778)
- [Hackers Exploit Roundcube N-Day Flaws to Steal Credentials and Deploy VShell](https://cybersecuritynews.com/hackers-exploit-roundcube-n-day-flaws/)
- [China-Aligned UNK_MassTraction Exploits Roundcube Servers to Target Universities](https://gbhackers.com/china-aligned-unk_masstraction/)
- [Suspected Chinese Threat Group Targets Universities](https://www.infosecurity-magazine.com/news/china-aligned-cluster-roundcube/)
- [CVE-2024-42009 Details - NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-42009)
- [CVE-2025-49113 Details - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-49113)
- [Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail](https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/)
- [Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113](https://fearsoff.org/research/roundcube)
- [CVE-2025-49113: Post-Auth Remote Code Execution in Roundcube via PHP Object Deserialization](https://www.offsec.com/blog/cve-2025-49113/)
- [Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization](https://github.com/advisories/GHSA-8j8w-wwqc-x596)
- [Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool](https://thehackernews.com/2025/04/chinese-hackers-target-linux-systems.html)
- [UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to VShell](https://www.sysdig.com/blog/unc5174-chinese-threat-actor-vshell)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1162