Loading story…
A suspected China-aligned espionage cluster tracked as UNK_MassTraction targeted Roundcube mail servers at U.S. and Canadian universities, focusing on physics and engineering departments, administrators, professors with national security ties, and institutions involved in astrophysics and particle physics research. Proofpoint said the campaign began in May and remains ongoing, with fewer than 10 confirmed victims but a potential impact spanning a few dozen universities. The attackers used compromised or spoofed email accounts in low-volume operations designed to steal sensitive data and establish persistent access inside university networks.
The intrusion chain combined two critical Roundcube flaws, CVE-2024-42009 and CVE-2025-49113, beginning with a malicious email that required only that a target open it to trigger JavaScript in the victim's webmail session. That access was used to deploy the IceCube credential stealer and then gain server-side control through the SquareShell webshell or an in-memory VShell backdoor, enabling the mail server to be used as a pivot into broader campus environments. Proofpoint linked the activity to China-aligned operations based on Chinese-language artifacts, overlap with covert infrastructure used by other China-linked groups, and the use of VShell, while also noting mature tradecraft such as cleanup routines, fallback mechanisms, deferred triggers, timestomping, and in-memory execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Proofpoint identified fewer than 10 confirmed university victims and said a few dozen universities may ultimately be affected. The company also scanned compromised servers for the SquareShell webshell and notified victims it identified.
In the campaign, the attackers exploited CVE-2024-42009 and CVE-2025-49113 in sequence, beginning with malicious JavaScript triggered when a victim opened an email and escalating to server-side access. Proofpoint said the chain enabled deployment of the IceCube credential stealer and persistence via the SquareShell webshell or an in-memory VShell backdoor.
Since May 2026, Proofpoint observed a suspected China-aligned espionage cluster targeting Roundcube mailservers at physics and engineering departments in U.S. and Canadian universities. The campaign used low-volume, targeted emails and focused on stealing sensitive data and establishing persistent access.
Proofpoint published research describing the ongoing campaign, tracking the activity cluster as UNK_MassTraction and assessing it as likely China-aligned. The report cited Chinese-language artifacts, use of VShell, targeting patterns, and infrastructure overlap with other China-aligned activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcecommunity.gurucul.com
Open sourcetheregister.com
Open sourceblog.talosintelligence.com
Open sourcecensys.com
Open sourceblog.eclecticiq.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia-aligned espionage groups **TA458** and **TA488** have been exploiting vulnerabilities in webmail platforms including **Roundcube, Zimbra, SOGo, mDaemon, Kerio,** and **SOGo** to compromise government and defense targets through so-called **"half-click"** attacks, where opening a malicious email in a webmail session triggers attacker-controlled JavaScript. Proofpoint reported TA458 used a **SOGo zero-day** later patched as `CVE-2026-8496`, while TA488 exploited a previously unknown **Zimbra** flaw assigned `CVE-2025-66376` for months. The campaigns targeted Ukrainian government entities, Eastern European military and government organizations, and parts of the U.S. defense industrial base and nuclear sector, with malware such as **SpyPress** and **ZimReaper** stealing credentials, contacts, emails, CSRF tokens, and app-specific passwords to bypass multifactor protections. Reporting on **APT28** infrastructure exposed in early 2026 tied the broader **Operation RoundPress** activity to a larger webmail espionage program that relied heavily on patched but unremediated flaws, including `CVE-2020-35730`, `CVE-2023-43770`, `CVE-2021-44026`, and `CVE-2020-12641` in Roundcube. Researchers said the leaked toolkit included XSS payloads, a Flask-based command-and-control server, a Go implant for GNU/Linux, operator bash history, and victim data, revealing poor operational security and overlap between staging, exfiltration, and pivot infrastructure. TA458 was also observed chaining a Roundcube XSS vector with `CVE-2025-49113` to achieve PHP deserialization and arbitrary code execution, showing that the actors are pursuing not only mailbox theft and forwarding-rule abuse but also persistent server-side access.
Aug 11, 2026
Researchers and government agencies reported that the Russia-linked **APT28** espionage cluster has continued and expanded **Operation RoundPress**, a campaign that compromises vulnerable webmail platforms when targets open specially crafted phishing emails. ESET said the operation began against **Roundcube** and later spread to **Horde, MDaemon, and Zimbra**, using cross-site scripting flaws to inject malicious JavaScript into active mail sessions and steal credentials, emails, contacts, and in some cases **2FA secrets** and app passwords. Proofpoint said the activity persisted into 2026 with a new “half-click” zero-day in **SOGo** tracked as `CVE-2026-8496`, while also noting exploitation against **Zimbra, MDaemon, Kerio, and Roundcube** and a modified SpyPress chain that paired a Roundcube XSS vector with `CVE-2025-49113` to pursue server-side code execution and longer-term access. The victim set has centered on **government, military, diplomatic, and defense-related organizations**, especially in **Ukraine and Eastern Europe**, but reporting also identified targets in **France, Africa, Europe, and South America**. ANSSI said French entities have faced repeated APT28 intrusions since 2021 using phishing, webmail brute force, edge-device compromise, and exploitation of flaws including `CVE-2023-23397`, with recurring Roundcube-focused operations and credential theft infrastructure. CERT-UA separately linked a phishing campaign against Ukrainian local government bodies to **UAC-0001/APT28** with medium confidence, citing infrastructure overlap with an earlier **Roundcube** compromise involving `CVE-2023-43770` that stole mailbox credentials and created malicious mail-forwarding rules. Across the reporting, the campaign is described as a strategic intelligence-collection effort tied to Russian state interests and the war in Ukraine.
Jul 29, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026