Chinese hackers exploit Roundcube in university attacks

A China-aligned threat cluster tracked as UNK_MassTraction has exploited Roundcube vulnerabilities CVE-2024-42009 and CVE-2025-49113 to target U.S. and Canadian universities since May. The attackers steal credentials and deploy IceCube stealer, SquareShell webshell, and VShell backdoor, focusing on physics, engineering, and national security-related departments.