UNK_MassTraction is a suspected China-aligned espionage threat cluster first tracked by Proofpoint beginning in May 2026. The campaign opens with phishing emails sent from compromised third-party mailboxes (e.g. jpcontreras@newfield.cl) and spoofed, DMARC-weak domains, crafted to look like generic marketing/spam so recipients do not scrutinize them. The messages carry a specially crafted HTML body that abuses insufficient sanitization in Roundcube Webmail's mail-display function: an animation-event handler (onanimationstart) executes a decimal-encoded JavaScript loader the moment the message is opened in a vulnerable Roundcube client, tracked as CVE-2024-42009 (CVSS 9.3, CWE-79 stored/reflected XSS).

That loader delivers IceCube, a purpose-built JavaScript credential and session stealer that runs inside the victim's authenticated Roundcube session. IceCube performs DOM traversal to escape iframes, harvests usernames/passwords and any 2FA material entered into the page, steals session and CSRF cookies/tokens, fingerprints the browser (language, screen size, form data), and sets deferred triggers on the logout button and page-close events so it can clean up evidence and destroy forensic traces of the session before the victim notices. Code review of IceCube samples shows verbose, LLM-generated code comments and iterative "phase" markers, suggesting AI-assisted malware development, plus resilient retry/fallback logic for reliability across variable network conditions.

With stolen session material, the actor pivots to a second, more serious Roundcube flaw: CVE-2025-49113 (CVSS 9.9, CWE-502), an insufficiently validated `_from` parameter in `program/actions/settings/upload.php` that allows an authenticated user to trigger PHP object deserialization and reach a gadget chain culminating in `__destruct()`-driven command execution. The actor sends a crafted HTTP POST containing serialized PHP payload data (with a valid CSRF token obtained via the IceCube session hijack) to instantiate the gadget chain and execute arbitrary shell commands on the mail server itself — moving from a client-side webmail compromise to full server-side RCE on the mailserver host.

Server-side access is used to drop SquareShell, a small PHP webshell written to `plugins/newmail_notifier/mail_preview.php` inside the Roundcube plugin directory and timestomped to match the legitimate plugin's modification time to blend in with routine file activity. SquareShell exposes `system`, `passthru`, `exec`, `shell_exec`, `assert`, and `popen` execution primitives to give the operator durable, remotely reachable command execution independent of any further Roundcube exploitation.

Beginning in June 2026 the group introduced a fallback deployment mechanism: rather than relying solely on the PHP webshell, compromised servers are used to pull down and in-memory-load VShell, a mature Go-based, multi-platform (Windows/Linux/macOS) backdoor previously documented in numerous China-nexus campaigns (UNC5174/Uteus, UAT-8302, CL-STA-0048, Earth Lamia's "Operation DRAGONCLONE"). The loader downloaded onto UNK_MassTraction victims is architecture-dependent, checks `/tmp/log_de.log` to avoid duplicate execution, wraps itself with `nohup`, and masquerades in the process table as `[kworker/0:2]` — a well-known VShell evasion signature — to blend into normal Linux kernel worker-thread noise. Once running, VShell gives the operator an interactive shell, port-forwarding, and network-pivoting capability entirely in memory, without touching disk, complicating file-based detection and incident response on university-owned Linux mail infrastructure.

Targeting is unusually narrow and deliberate: rather than broad opportunistic phishing, UNK_MassTraction concentrates on physics and engineering department administrators and professors at US and Canadian universities, prioritizing institutions with astrophysics and particle physics programs carrying national-security relevance (e.g. dual-use research, DOE/DoD-funded labs, ITAR-adjacent instrumentation). Attribution to a China-aligned cluster rests on: access to covert VPS infrastructure shared with other known China-nexus operators; Chinese-language artifacts present in phishing email HTML source; and VShell's consistent association with Chinese state-linked toolkits and operators (UNC5174, UAT-8302, Earth Lamia, CL-STA-0048) across unrelated campaigns and targets. Proofpoint scanned relevant internet address space to identify additional SquareShell-infected Roundcube servers beyond the observed sample set and coordinated victim notification with government and industry partners.

Both exploited CVEs were independently confirmed under active exploitation by CISA, which added CVE-2025-49113 (alongside CVE-2025-68461) to the Known Exploited Vulnerabilities catalog on 2026-02-20 with a federal remediation deadline of 2026-03-13; a commercial exploit for CVE-2025-49113 was reportedly for sale within 48 hours of public disclosure. CVE-2024-42009 has separately been observed exploited by unrelated actors including APT28 and Winter Vivern, underscoring Roundcube's status as a recurring high-value target due to its wide deployment and historically slow organizational patch cadence.