Hackers exploit Roundcube flaw to spy on academic researchers

A China-linked threat group has been exploiting vulnerabilities in Roundcube webmail servers at U.S. and Canadian universities to steal login details and install backdoor malware. The attackers, tracked as UNK_MassTraction, have focused on institutions conducting research in physics, engineering, and national security. They use a cross-site scripting flaw (CVE-2024-42009) to deliver a credential-stealing payload named IceCube, followed by additional exploits like CVE-2025-49113 to gain deeper access. Security experts recommend applying the latest patches from Roundcube to mitigate these risks.