{
  "Event": {
    "analysis": "1",
    "date": "2026-07-07",
    "extends_uuid": "",
    "info": "[Threat Intel] One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation",
    "protected": false,
    "publish_timestamp": "1784321930",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784321930",
    "uuid": "c8b03978-9d84-4997-9d73-40388b94c4c5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#2d8ee7",
        "local": false,
        "name": "misp-galaxy:producer=\"Proofpoint\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#1faf16",
        "local": false,
        "name": "misp-galaxy:target-information=\"Canada\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"china\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"SNOWLIGHT\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Vshell\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "link",
        "uuid": "c7175670-f410-437e-9fac-50c64057d876",
        "value": "https://www.proofpoint.com/us/blog/threat-insight/one-email-closer-edge-unkmasstraction-physics-exploitation"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "text",
        "uuid": "ef0d387c-d2b7-465d-a152-bf7d303de677",
        "value": "Since May 2026, a suspected China-aligned threat cluster named UNK_MassTraction has been exploiting Roundcube mailservers at physics and engineering departments of US and Canadian universities. The campaigns exploit multiple n-day vulnerabilities including CVE-2024-42009 and CVE-2025-49113 to steal credentials and deploy either a webshell called SquareShell or the VShell backdoor into server memory. The actor uses an initial cross-site scripting vulnerability to execute JavaScript, then deploys IceCube stealer to harvest authentication material before pivoting server-side through deserialization exploits. The operators deliberately crafted their infection chain with mature tooling to avoid detection, using Roundcube servers as pivot points to enter target networks. The targeting focuses on departments with national security ties or those studying astrophysics and particle physics."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "text",
        "uuid": "0991cb11-4296-4f3d-aa9f-49e9ec7b2e8f",
        "value": "Name: One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation\nAuthor: AlienVault\nAdversary: UNK_MassTraction\nTags: [\"squareshell\", \"cve-2024-42009\", \"snowlight\", \"cve-2023-2868\", \"university targeting\", \"roundcube exploitation\", \"squareshell webshell\", \"vshell\", \"china-aligned\", \"icecube\", \"icecube stealer\", \"cve-2025-49113\", \"unk_masstraction\", \"vshell backdoor\", \"cross-site scripting\"]\nTgtd countries: [\"United States of America\", \"Canada\"]\nMlwr families: [\"IceCube\", \"SquareShell\", \"VShell\", \"SNOWLIGHT\"]\nAttack_ids: []\nIndustries: [\"Education\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "2aee164f-3620-4f2f-ba31-1e66227752fd",
        "value": "UNK_MassTraction"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "9c541b4a-aced-45bf-8243-f6b943aa1e22",
        "value": "CVE-2023-2868"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "4dbb6fa9-ccff-4b57-b68c-5b3880b84685",
        "value": "CVE-2024-42009"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783508412",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a3c7f9aa-96e9-434b-a384-00959714beb5",
        "value": "CVE-2025-49113"
      },
      {
        "category": "Network activity",
        "comment": "IOC-description:CC=US ASN=AS62005 bluevps ou",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784307047",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e00a0977-a6f2-43b3-b783-4859a2233db5",
        "value": "45.86.229.111",
        "Tag": [
          {
            "colour": "#5bbe18",
            "local": false,
            "name": "asn:asn=\"62005\"",
            "relationship_type": ""
          },
          {
            "colour": "#f29312",
            "local": false,
            "name": "asn:as-owner=\"BV-EU-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#c1f0e1",
            "local": false,
            "name": "asn:as-country=\"EE\"",
            "relationship_type": ""
          },
          {
            "colour": "#5e1145",
            "local": false,
            "name": "misp-galaxy:country=\"estonia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IOC-description:CC=GB ASN=ASNone",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784307068",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "37684d83-77b2-421e-93a7-09b2ad82d9d4",
        "value": "194.213.18.133",
        "Tag": [
          {
            "colour": "#7bf968",
            "local": false,
            "name": "asn:asn=\"62240\"",
            "relationship_type": ""
          },
          {
            "colour": "#9d2170",
            "local": false,
            "name": "asn:as-owner=\"CLOUVIDER Clouvider - Global ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IOC-description:CC=BG ASN=AS57844 spdnet telekomunikasyon hizmetleri bilgi teknolojileri taahhut sanayi ve ticaret a.s.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784307089",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "3240fb24-bef3-4543-9c10-c9cd3feae209",
        "value": "45.150.109.151",
        "Tag": [
          {
            "colour": "#5bbe18",
            "local": false,
            "name": "asn:asn=\"62005\"",
            "relationship_type": ""
          },
          {
            "colour": "#f29312",
            "local": false,
            "name": "asn:as-owner=\"BV-EU-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#c1f0e1",
            "local": false,
            "name": "asn:as-country=\"EE\"",
            "relationship_type": ""
          },
          {
            "colour": "#5e1145",
            "local": false,
            "name": "misp-galaxy:country=\"estonia\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784307110",
        "to_ids": true,
        "type": "url",
        "uuid": "876bf954-93c0-4ea9-b475-370ee8af2c04",
        "value": "https://45.150.109.151.sslip.io:23088/app/js/jquery.min.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784307132",
        "to_ids": true,
        "type": "url",
        "uuid": "c5706e29-77a9-4478-acb2-62cd95b4eb76",
        "value": "https://194.213.18.133.sslip.io:23088/app/js/jquery.min.js",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-07T14:29:49+00:00",
        "last_seen": "2026-07-10T01:11:52+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784307153",
        "uuid": "1bcfffae-a819-442d-8abf-03a9cddb5fdf",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "md5",
            "timestamp": "1784307153",
            "to_ids": true,
            "type": "md5",
            "uuid": "d01636c6-096b-4ca3-a12e-ab10314fb257",
            "value": "1d865b3a5b803febddaa2a0c07099ceb",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "sha1",
            "timestamp": "1784305111",
            "to_ids": true,
            "type": "sha1",
            "uuid": "6f27c9a4-b242-4ad0-8401-8c11f2186f5a",
            "value": "1d0f8dd934cd975e0b70e1c2d8b1c5b2d438b25d",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "sha256",
            "timestamp": "1784305111",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a79d503e-d66a-4184-b451-f79a48d45d39",
            "value": "a02f124c5ce4180bd130a62ee03262f399c33491de3aed36e0b15155ae4926c0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "text",
            "timestamp": "1784304344",
            "to_ids": false,
            "type": "text",
            "uuid": "1468e366-a0f1-4a22-a020-2c929220cb6a",
            "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Seen In The Wild: 2026-07-07T18:53:46+00:00\nFirst Submission: 2026-07-07T14:29:49+00:00\nLast Submission: 2026-07-10T01:11:52+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784304344",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "5cb65250-4aed-45a8-a547-098204b65bd2",
            "value": "1536:z3/FDn7lLjNaofMfZEn+EoMMNi2kswUgpwahEp+dXP3FocDLJMwwr01wvpBk:HH4NkZp/4CVntMvs"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784304344",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "45bf6837-0ff5-4490-8ca7-9ba9d722cd3e",
            "value": "52833"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "vhash",
            "timestamp": "1784304344",
            "to_ids": true,
            "type": "vhash",
            "uuid": "17c8a5e9-4d96-4951-97a2-e2526a801a7f",
            "value": "6114f3abbcd7b4ebde2e027a9cf8373e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-07T14:29:49+00:00",
            "last_seen": "2026-07-10T01:11:52+00:00",
            "object_relation": "filename",
            "timestamp": "1784304344",
            "to_ids": true,
            "type": "filename",
            "uuid": "8ec08c9a-9180-4425-9df9-1d3ac78b61fc",
            "value": "a02f124c5ce4180bd130a62ee03262f399c33491de3aed36e0b15155ae4926c0.js"
          }
        ]
      }
    ]
  }
}