IceCube

IceCube is a malware name used for two distinct espionage-related implants in separate contexts. The better-known current usage refers to a JavaScript-based Roundcube-focused stealer used in a suspected China-aligned campaign against vulnerable university webmail servers in the United States and Canada. In that activity, phishing emails were crafted so that merely opening the message in a vulnerable Roundcube instance triggered exploitation of CVE-2024-42009, executing attacker-controlled JavaScript in the victim’s browser. IceCube then escaped Roundcube’s iframe context through DOM traversal, accessed the broader browser DOM and authenticated Roundcube session, and harvested usernames, passwords, session tokens, cookies, two-factor authentication material, browser language, screen size, and form field values. It also used the compromised session and CSRF material to facilitate follow-on exploitation of CVE-2025-49113 in attempts to gain server-side execution and deploy additional tooling such as SquareShell or VShell. The campaign was tracked as UNK_MassTraction and targeted physics, engineering, astrophysics, particle physics, and national-security-related research organizations, with attribution assessed at low confidence as China-aligned.

The name IceCube also appears as a plugin package within the older Android MOONSHINE surveillance framework associated with the POISON CARP campaign targeting Tibetan organizations. In that context, IceCube was not the primary implant but an auxiliary Android plugin that extended surveillance functions, including camera access, microphone recording, screenshots, notifications, and shell command execution. Because the same name is used for unrelated malware components, analysts should disambiguate IceCube by campaign and platform before use.