China-Aligned Hackers Exploit Unpatched Roundcube Flaws at Universities
The UNK_MassTraction threat group is actively exploiting two critical vulnerabilities (CVE-2024-42009 and CVE-2025-49113) in Roundcube webmail software that universities have failed to patch in a timely manner. By targeting internet-facing email infrastructure at physics and engineering departments, attackers can steal credentials and deploy persistent backdoors like web shells and VShell. Universities are particularly high-value targets due to their sensitive research data and historically slower patch cycles compared to corporate environments. This campaign highlights the danger of leaving known, exploited vulnerabilities unpatched on publicly accessible systems, especially those handling institutional credentials.
Tactical Insight
Immediate actions
- Patch Roundcube webmail to the latest version immediately, prioritizing CVE-2024-42009 and CVE-2025-49113.
- Conduct a forensic review of Roundcube server logs for signs of web shell deployment or unauthorized access.
- Force a credential reset for all users of affected webmail systems to invalidate any stolen credentials.
Long-term improvements
- Establish a formal patch management policy with SLA timelines (e.g., critical patches applied within 72 hours) for all internet-facing applications.
- Maintain a continuously updated inventory of all externally exposed services and their software versions.
- Implement multi-factor authentication (MFA) on all webmail and email infrastructure to reduce the impact of credential theft.
Detection measures
- Deploy a Web Application Firewall (WAF) in front of Roundcube and similar webmail platforms to detect and block exploit attempts.
- Enable centralized logging and alerting for anomalous authentication events, new file creation, and outbound connections from mail servers.
- Subscribe to threat intelligence feeds to receive early warning of CVEs being actively exploited in the wild.