Уязвимости в Roundcube используются для слежки за учеными

Researchers at Proofpoint have uncovered a cyber espionage campaign targeting universities in the US and Canada, exploiting vulnerabilities in Roundcube Webmail to monitor scientists and faculty members. The attackers use CVE-2024-42009 (XSS flaw) and CVE-2025-49113 (deserialization bug) to steal login credentials and install malicious web shells like SquareShell and VShell. These tools allow remote code execution and network access, enabling long-term persistence on compromised systems. The threat group, tracked as UNK_MassTraction, is suspected to be linked to China due to infrastructure overlaps and linguistic clues.