SquareShell

SquareShell is a PHP webshell used to obtain remote code execution on compromised Roundcube mail servers. It has been observed in a targeted espionage campaign against universities in the United States and Canada, particularly organizations and departments associated with physics, engineering, astrophysics, particle physics, and national-security-related research. The activity has been tracked as UNK_MassTraction and assessed with low confidence as China-aligned based on infrastructure overlap, Chinese-language artifacts, and tradecraft consistent with prior Chinese intrusions into internet-facing mail systems.

In the observed intrusion chain, attackers first used phishing emails to trigger exploitation of Roundcube cross-site scripting vulnerability CVE-2024-42009 when a victim opened a crafted message in vulnerable webmail. After harvesting access through the associated credential-stealing stage, the operators attempted to exploit Roundcube deserialization vulnerability CVE-2025-49113 to gain server-side execution and write SquareShell to disk. Once deployed, SquareShell provided remote command execution on the mail server, enabling post-compromise control of the host. Reporting also indicates the webshell was timestomped to better blend into the environment, reflecting deliberate defense-evasion tradecraft.

SquareShell is best characterized as a server-side webshell used for post-exploitation on Linux-hosted PHP webmail infrastructure. In the same campaign, operators used VShell as a fallback implant when webshell deployment failed, suggesting SquareShell formed part of a broader toolchain for maintaining access and pivoting from exposed mail servers into internal networks.