A threat cluster dubbed UNK_MassTraction, likely China-aligned as attributed by Proofpoint, is exploiting vulnerable Roundcube webmail servers at US and Canadian universities. Researchers have found the threat actor group primarily targeting physics and engineering departments and research tied to astrophysics, particle physics, and national security. The attacks start with generic phishing emails from compromised or spoofed accounts. When the malicious email is opened in a vulnerable Roundcube client, they exploit XSS flaw CVE-2024-42009 to run JavaScript that loads IceCube, a stealer that harvests usernames, passwords, cookies, multi-factor authentication (MFA) data, and browser info. IceCube then uses helpers to exploit Roundcube deserialization bug CVE-2025-49113 and tries to install SquareShell, a PHP webshell for remote code execution. If that fails, it fetches a script that loads VShell, a Go-based backdoor offering interactive shell and port forwarding, that Proofpoint points out is commonly used by Chinese actors. Proofpoint links the campaign to China via overlapping VPS infrastructure, Chinese-language artifacts, and the characteristic tactic of using internet-facing mail servers as an internal foothold, though attribution remains low-confidence. CTIX Analysts recommend that admins patch both CVEs and treat mail servers as high-value remote access nodes.