A chained exploit requiring only an opened email is giving attackers persistent access to physics and engineering departments across North American universities.
Summary
- Proofpoint’s UNK_MassTraction cluster, assessed as China-aligned, has compromised fewer than ten confirmed university victims, with researchers estimating several dozen may ultimately be affected.
- The attack chain links two critical Roundcube vulnerabilities — CVE-2024-42009 and CVE-2025-49113 — to execute malicious JavaScript in the browser and then establish a foothold on the mail server itself.
- Triggering the initial exploit requires only that the recipient open a phishing email; no link click or attachment interaction is needed.
- Post-compromise tools include webshells, backdoors, and the VShell implant, with Chinese-language artefacts found in the lure emails.
- Proofpoint states the campaign is ongoing and believes many victims are not yet aware they have been compromised.
A Campaign Quietly Running Since May
Proofpoint threat researchers publicly disclosed the campaign on Tuesday, having first observed activity in May. The cluster they track as UNK_MassTraction has been methodically targeting physics and engineering departments at universities in the United States and Canada, with a particular focus on administrators and academics who have links to national security organisations or who conduct research in astrophysics and particle physics.
How the Exploit Chain Works
The attack begins with a generic-looking phishing email. When the recipient opens it — no click on a link, no macro to enable — CVE-2024-42009, a critical vulnerability in the open-source Roundcube webmail client, executes malicious JavaScript directly inside the victim’s browser. That initial execution is then chained with CVE-2025-49113, which moves the compromise from the browser session to the underlying mail server. From there, attackers deploy webshells and backdoors to secure persistent access.
Why This Delivery Mechanism Stands Out
Greg Lesnewich, principal threat researcher at Proofpoint, noted that China-aligned groups have historically favoured edge devices — routers and VPN concentrators — as entry points, using email primarily to deliver credential-harvesting links or malware to end users. This campaign inverts that model. The email itself is the exploit delivery vehicle, and the target is not the user’s workstation but the mail server. That distinction matters: organisations that have hardened endpoint defences and trained users on suspicious links may still be exposed if their Roundcube instance remains unpatched.
Attribution Indicators
Proofpoint attributes UNK_MassTraction to a China-aligned actor on the basis of three factors: the use of a covert network infrastructure previously associated with multiple China-aligned threat groups; an infection chain that results in the deployment of VShell, a known tool in that ecosystem; and Chinese-language artefacts embedded in the phishing emails. Proofpoint has not made a more specific attribution to a named state entity.
Scope and What Remains Unknown
Proofpoint has confirmed fewer than ten victims directly, but Lesnewich estimates the true number of compromised universities could reach several dozen. Critically, the company’s visibility is limited to the inbound email stage. “We do not have data to suggest what got stolen, as we only observe the initial inbound email attempt,” Lesnewich told CyberScoop. What has been removed from affected networks — if anything — is not known from the available sources. Lesnewich did note that the research domains targeted align with China’s stated strategic priorities, though he stopped short of drawing specific conclusions about intent.
Broader Context
This activity sits within a wider pattern of China-aligned espionage targeting research institutions. Google threat hunters recently reported a separate Chinese state-sponsored group that had maintained access to systems across academia, medicine, military, cybersecurity, and foreign policy for extended periods. The Roundcube campaign represents a distinct cluster and methodology, but the broader targeting rationale — sensitive research with strategic or national security relevance — is consistent across multiple documented operations.
Why it matters
For CISOs responsible for higher education or any environment running Roundcube, this campaign removes a common assumption: that a phishing email is only dangerous if a user acts on it beyond opening it. The zero-interaction nature of CVE-2024-42009 means standard user-awareness training offers no protection here. The subsequent server-level compromise via CVE-2025-49113 means attackers gain a persistent position on infrastructure, not just an endpoint — complicating detection and containment. With Proofpoint assessing the campaign as ongoing and many victims likely unaware, organisations in research, defence-adjacent academia, and advanced sciences should treat this as an active exposure issue rather than a watch-and-wait situation.
What to do now
- Audit your environment for any deployment of Roundcube webmail and confirm whether CVE-2024-42009 and CVE-2025-49113 have been patched; apply available patches immediately if not.
- Review mail server logs for evidence of unexpected JavaScript execution, unusual outbound connections, or unauthorised files consistent with webshell deployment.
- Check for the presence of VShell or other unfamiliar binaries on mail server infrastructure, particularly in environments supporting physics, engineering, or national security-adjacent research.
- If your organisation falls within the targeting profile — astrophysics, particle physics, engineering departments with government links — consider proactively engaging a threat intelligence or incident response partner to assess whether compromise has occurred.
- Notify relevant information-sharing bodies and, where applicable, national cybersecurity agencies if suspicious activity consistent with this campaign is identified.
