OTX Threat: One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation

Since May 2026, a suspected China-aligned threat cluster named UNK_MassTraction has been exploiting Roundcube mailservers at physics and engineering departments of US and Canadian universities. The campaigns exploit multiple n-day vulnerabilities including CVE-2024-42009 and CVE-2025-49113 to steal credentials and deploy either a webshell called SquareShell or the VShell backdoor into server memor CVEs: CVE-2023-2868, CVE-2024-42009, CVE-2025-49113 Sectors: Education