UNK_MassTraction: China-Aligned Threat Cluster Exploiting Roundcube

UNK_MassTraction is a suspected China-aligned threat activity cluster first detected by Proofpoint in May 2026. It targets physics and engineering departments at U.S. and Canadian universities by exploiting Roundcube vulnerabilities CVE-2024-42009 and CVE-2025-49113. The group uses IceCube malware for credential theft and deploys VShell or SquareShell for persistent access. This marks the first known Chinese hacking group exploiting Roundcube flaws.