UNK_MassTraction Strikes: How China-Aligned Hackers Weaponize Roundcube Flaws to Deploy SquareShell and VShell Backdoors + Video

Listen to this Post

🐢▶️ Listen🚀

Introduction:

A sophisticated cyber espionage campaign, tracked as UNK_MassTraction, has been actively exploiting critical vulnerabilities in Roundcube webmail servers to infiltrate U.S. and Canadian universities, with a particular focus on physics and engineering departments. The attack chain begins with a phishing email that triggers a cross-site scripting flaw (CVE-2024-42009), loading a JavaScript stealer called IceCube to harvest credentials, cookies, and two-factor authentication data. Attackers then leverage a post-authentication remote code execution vulnerability (CVE-2025-49113, CVSS 9.9) to deploy either a PHP webshell known as SquareShell or a memory-only backdoor called VShell, establishing persistent access to victim networks.

Learning Objectives:

• Understand the complete attack chain of the UNK_MassTraction campaign, from phishing to post-exploitation.
• Identify indicators of compromise (IoCs) and detection strategies for IceCube, SquareShell, SNOWLIGHT, and VShell.
• Learn step-by-step mitigation techniques, including patching, log analysis, and memory forensics.
• Acquire practical Linux/Windows commands to hunt for webshells and memory-resident backdoors.

1. Understanding the Attack Chain: From Phishing to Memory-Resident Backdoors

The UNK_MassTraction campaign is a multi-stage attack that demonstrates advanced tradecraft. The initial vector is a phishing email sent to targets within university research departments. These emails contain malicious JavaScript that exploits CVE-2024-42009, a cross-site scripting (XSS) vulnerability in Roundcube. Upon successful exploitation, the IceCube payload is loaded into the victim’s browser. IceCube is a sophisticated JavaScript stealer that captures usernames, passwords, session cookies, two-factor authentication tokens, browser language, screen size, and form values. This harvested data is exfiltrated via HTTP POST requests.

Once the attacker has obtained valid session credentials, they pivot to exploit CVE-2025-49113, a critical post-authentication remote code execution flaw. This vulnerability allows the attacker to execute arbitrary PHP code on the mail server. The attacker then attempts to deploy SquareShell, a PHP-based webshell, through a PHP gadget shell command. If this deployment fails, a fallback shell script is used to install the SNOWLIGHT ELF loader, which retrieves an architecture-compatible payload and launches VShell. VShell is a memory-only backdoor that leaves minimal forensic footprint, making it exceptionally difficult to detect.

Step-by-Step Guide: What This Does and How to Use It (Defensive Perspective)

To understand the attack, defenders must simulate or analyze the steps:

1. Phishing Simulation: Create a test phishing campaign to assess user vulnerability. Use tools like GoPhish to send emails with malicious links.
2. Vulnerability Assessment: Scan Roundcube instances for CVE-2024-42009 (XSS) and CVE-2025-49113 (RCE). Use vulnerability scanners like Nessus or OpenVAS.
3. Log Analysis: Review Roundcube and web server logs for suspicious POST requests and JavaScript payloads. Look for unusual `error_log` entries.
4. Memory Forensics: Use tools like Volatility to analyze memory dumps for signs of VShell or other memory-resident implants.
5. Webshell Detection: Scan web directories for unexpected PHP files containing obfuscated code or system command execution functions.

6. Detecting SquareShell and VShell: Indicators of Compromise (IoCs) and Hunting Commands

Hunting for these threats requires a combination of network monitoring, endpoint detection, and log analysis. NVISO and Proofpoint have released key IoCs.

Network-Based Detection:

• Monitor for suspicious HTTP POST requests to Roundcube endpoints, especially those with large payloads or unusual user agents.
• Look for outbound connections from the mail server to unknown IP addresses, particularly over ports 443 or 80.
• Analyze DNS logs for queries to domains associated with the campaign.

Host-Based Detection (Linux):

• Find recently modified PHP files:

  find /var/www/html/ -1ame ".php" -mtime -7 -exec ls -la {} \;
  

• Search for PHP files containing common webshell functions:

  grep -r -E "(eval|base64_decode|system|exec|passthru|shell_exec)" /var/www/html/ --include=".php"
  

• Check for unexpected processes:

  ps aux | grep -E "php|perl|python|nc|netcat"
  

• Look for the SNOWLIGHT ELF loader:

  find / -1ame "snowlight" -type f 2>/dev/null
  

• Inspect crontab for persistence:

  crontab -l
  

  cat /etc/crontab
  

Host-Based Detection (Windows):

• Search for recently created ASPX or PHP files in IIS directories:

  Get-ChildItem -Path C:\inetpub\wwwroot -Recurse -Include .aspx,.php | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
  

• Look for suspicious PowerShell commands in event logs:

  Get-WinEvent -LogName "Windows PowerShell" | Where-Object { $_.Message -match "Invoke-Expression|IEX|DownloadString" }
  

• Check for unusual scheduled tasks:

  Get-ScheduledTask | Where-Object { $_.State -1e "Disabled" }
  

3. Patching Roundcube Vulnerabilities: CVE-2024-42009 and CVE-2025-49113

Immediate patching is the most critical mitigation step. CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Step-by-Step Guide: Patching Roundcube

1. Identify Version:

• Log in to your Roundcube instance and check the version in the footer or via index.php?_task=about.
• Alternatively, check the version in the `program/include/iniset.php` file.

2. Backup:

• Backup the entire Roundcube directory and the database:

  tar -czvf roundcube_backup_$(date +%Y%m%d).tar.gz /var/www/html/roundcube/
  

  mysqldump -u root -p roundcubemail > roundcube_db_backup.sql
  

3. Download the Latest Version:

• Visit the official Roundcube website or GitHub repository to download the latest patched version.
• As of July 2026, versions 1.6.10 and 1.5.10 contain the necessary fixes.

4. Apply Update:

• Extract the new files over the existing installation (ensure you preserve the `config/` directory).

  tar -xzvf roundcube-1.6.10.tar.gz
  cp -r roundcube-1.6.10/ /var/www/html/roundcube/
  

5. Update Database:

• Run the database schema update script if required:

  cd /var/www/html/roundcube
  php bin/updatedb.sh
  

6. Verify:

• Log in to Roundcube and confirm the version has been updated.
• Test email functionality to ensure nothing is broken.

7. Restrict Access:

• If possible, restrict Roundcube access to internal networks or require VPN access.

4. Memory Forensics for VShell: Detecting Memory-Only Backdoors

VShell is designed to reside entirely in memory, making it invisible to traditional file-based scans. Detecting it requires memory forensics.

Step-by-Step Guide: Memory Forensics with Volatility

1. Acquire Memory Dump:

• On Linux, use `fmem` or `LiME` to dump physical memory.

  insmod ./lime.ko "path=/tmp/memory.lime format=lime"
  

• On Windows, use tools like `WinPMEM` or DumpIt.

2. Analyze with Volatility:

• Identify the OS profile:

  volatility -f memory.dump imageinfo
  

• List running processes:

  volatility -f memory.dump --profile=Win10x64 pslist
  

  volatility -f memory.dump --profile=LinuxUbuntu_5_4_0-42-generic linux_pslist
  

• Look for processes with no associated file on disk or with suspicious names.
• Dump suspicious processes for further analysis:

  volatility -f memory.dump --profile=Win10x64 procdump -p [bash] -D ./output/
  

3. Detect VShell Artifacts:

• VShell may create named pipes or mutexes. Use the `handles` or `mutantscan` plugins.
• Look for injected code in legitimate processes using the `malfind` plugin.
• Analyze network connections to identify C2 communication:

  volatility -f memory.dump --profile=Win10x64 netscan
  

1. Incident Response and Log Analysis: Uncovering the Attack

Effective incident response requires meticulous log analysis. The IceCube malware uses “deferred triggers” that reattempt exploitation when users leave pages or switch tabs, complicating investigations. It also destroys sessions to erase forensic traces.

Step-by-Step Guide: Log Analysis

1. Collect Logs:

• Roundcube Logs: /var/log/roundcubemail/errors.log, `/var/log/roundcubemail/sendmail.log`
  – Web Server Logs: /var/log/apache2/access.log, `/var/log/apache2/error.log` (or Nginx equivalent)
• System Logs: /var/log/syslog, `/var/log/auth.log`

2. Search for Suspicious POST Requests:

• Look for POST requests to `?_task=mail` or `?_task=settings` with unusual parameters.

  grep "POST" /var/log/apache2/access.log | grep -E "_task=mail|_task=settings" | grep -v "HTTP/1.1\" 200"
  

3. Identify JavaScript Payloads:

• Search for `eval` or `atob` in Roundcube logs.

  grep -E "eval|atob|fromCharCode" /var/log/roundcubemail/errors.log
  

4. Detect PHP Code Execution:

• Look for signs of PHP errors or warnings that indicate attempted code execution.

  grep "PHP Warning" /var/log/apache2/error.log
  

5. Correlate with Authentication Logs:

• Cross-reference suspicious activities with authentication logs to identify compromised accounts.

  grep "authentication" /var/log/auth.log
  

6. Hardening Roundcube and Mail Server Security

Beyond patching, several hardening measures can reduce the attack surface.

Step-by-Step Guide: Hardening

1. Restrict Public Access:

• Use a firewall to limit access to Roundcube to trusted IP ranges or VPN connections.

  iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
  iptables -A INPUT -p tcp --dport 443 -j DROP
  

2. Enable Multi-Factor Authentication (MFA):

• Implement MFA for all Roundcube users to mitigate credential theft.

3. Disable Unnecessary PHP Functions:

• In php.ini, disable dangerous functions like system, exec, shell_exec, passthru, `eval` in the `disable_functions` directive.

  disable_functions = system,exec,shell_exec,passthru,eval,pcntl_exec,proc_open
  

4. Implement Web Application Firewall (WAF):

• Deploy a WAF like ModSecurity with OWASP Core Rule Set to block common attack patterns.

5. Regular Security Audits:

• Conduct regular vulnerability scans and penetration tests.

6. Collect and Retain Forensic Logs:

• Ensure logs are centralized and retained for at least 90 days for forensic analysis.

What Undercode Say:

• Key Takeaway 1: The UNK_MassTraction campaign demonstrates the increasing sophistication of state-aligned threat actors, who are adept at chaining multiple vulnerabilities and using memory-resident malware to evade detection. The use of IceCube to steal 2FA tokens is particularly concerning, as it bypasses a key security control.
• Key Takeaway 2: Patching alone is insufficient. Organizations must adopt a defense-in-depth strategy that includes network monitoring, endpoint detection, memory forensics, and robust incident response procedures. The campaign’s ability to deploy VShell in memory underscores the need for advanced threat hunting capabilities.

Analysis:

The UNK_MassTraction campaign is a stark reminder that email servers are a prime target for cyber espionage. The attackers’ ability to pivot from a webmail vulnerability to full server compromise and persistent backdoor access highlights the critical need to treat mail servers as high-value assets. The campaign’s focus on research institutions, particularly in physics and engineering, suggests a strategic goal of stealing intellectual property and sensitive research data. The use of a memory-only backdoor like VShell indicates a high level of technical sophistication and a desire to maintain long-term, stealthy access. Defenders must move beyond signature-based detection and embrace behavioral analysis and threat hunting to uncover these advanced threats. The involvement of multiple threat actors using VShell also complicates attribution, emphasizing that the focus should be on detection and mitigation rather than solely on identifying the perpetrator.

Prediction:

• -1: The UNK_MassTraction campaign is likely to expand beyond universities to target other research organizations, government agencies, and enterprises that use Roundcube. The success of this campaign will likely inspire other threat actors to adopt similar techniques.
• -1: The use of memory-resident backdoors like VShell will become more prevalent, making traditional antivirus and file-based detection methods increasingly obsolete. This will force a shift towards endpoint detection and response (EDR) and memory forensics as core security capabilities.
• -1: The exploitation of Roundcube vulnerabilities will continue to be a significant threat vector until organizations prioritize patching and implement robust security controls. The presence of these flaws in the CISA KEV catalog will increase pressure on federal agencies to remediate, but many private sector organizations may remain vulnerable.
• +1: The increased awareness and research into campaigns like UNK_MassTraction will drive innovation in threat detection and incident response. The security community will develop new tools and techniques for hunting memory-resident malware and analyzing complex attack chains.
• -1: The attackers’ ability to steal 2FA tokens and destroy session data will make incident response and forensic investigation significantly more challenging. Organizations will need to invest in advanced logging and monitoring solutions to retain sufficient evidence for post-breach analysis.

▶️ Related Video (80% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Flavioqueiroz Squareshell – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky