Physics and engineering departments in the crosshairs
A threat cluster believed to be tied to China has been systematically compromising email servers at universities across the United States and Canada, using known flaws in the open-source webmail client Roundcube. Researchers at Proofpoint detailed the activity in a report published June 7, tracking it under the name UNK_MassTraction.
The attackers specifically targeted physics and engineering departments — academic units with potential links to national security research. Proofpoint assessed that the group selected these institutions after scanning for vulnerable Roundcube instances, not through random spray-and-pray tactics.
This is not a smash-and-grab operation. The goal appears to be persistent network access, not just email data theft.
Two vulnerabilities, one attack chain
The campaign exploited CVE-2024-42009, a cross-site scripting (XSS) flaw in Roundcube, to deliver a JavaScript payload that Proofpoint calls IceCube. When a victim opened a malicious email in a vulnerable webmail client, the exploit executed JavaScript in their browser. IceCube then stole usernames, passwords, cookies, and authentication data, while also mapping the victim’s environment.
But the attackers didn’t stop at credential theft. After gaining initial access to the Roundcube server, they turned to CVE-2025-49113, a deserialization vulnerability, to deploy a webshell or install the VShell backdoor directly in memory.
What VShell does
VShell is a publicly available Go-based remote access tool. It gives attackers interactive shell access and port-forwarding capabilities — exactly what you’d need to move laterally across a university network. Proofpoint noted that China-aligned operators have used VShell before, across Windows, Linux, and macOS environments.
The infection chain wasn’t simple. Proofpoint observed a multi-stage process:
- Credential theft via malicious JavaScript (IceCube)
- Server-side exploitation of vulnerable Roundcube components
- Deployment of webshells for persistent remote access
- Memory-based execution of the VShell backdoor
Each stage builds on the last. Steal a password, get into the mail server, then use a deserialization bug to plant a backdoor that survives reboots.
Why universities? Why now?
Academic institutions are attractive targets for espionage operations because they house cutting-edge research in physics, engineering, and other sensitive fields — often with less security than government labs. A compromised university email server can yield a treasure trove of correspondence, grant proposals, and unpublished data.
Proofpoint’s assessment ties UNK_MassTraction to espionage-focused objectives, citing the targeting pattern, infrastructure links, and Chinese-language artifacts found in some phishing emails. This follows a broader trend: China-aligned groups have been exploiting internet-facing infrastructure — VPNs, edge devices, public-facing applications — to gain footholds in targeted organizations. Roundcube servers are just the latest vector.
Treat email servers like VPN concentrators
Proofpoint’s warning is blunt: “The campaign is a reminder that email delivery can facilitate compromise of mail servers, and that Chinese operators will continue to treat them like any other edge device.”
The firm urged defenders to prioritize mail server security with the same rigor applied to VPN concentrators and other remote access nodes. That means patching Roundcube vulnerabilities promptly, monitoring for webshell activity, and scrutinizing outbound connections from email infrastructure.
For universities, the takeaway is clear. If your physics department runs a Roundcube server that’s months behind on patches, you’re not just risking email theft. You’re handing over the keys to the network.
