Hackers exploit Roundcube flaw to spy on researchers

A China-linked threat cluster tracked as UNK_MassTraction exploits Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. The campaign targets physics and engineering departments, using flaws CVE-2024-42009 and CVE-2025-49113 to deliver IceCube stealer and SquareShell webshell.