Signalis
sign in--:--:--UTC
Threat actors

UNK_MassTraction

☆ pin
Reports
3
First seen
Jul 7, 2026
Last seen
Jul 8, 2026
Motivation
Espionage

Relationships

CVE-2024-42009, in 3 of UNK_MassTraction's reports, exploited in the wild×3CVE-2024-42009CVE-2025-49113, in 3 of UNK_MassTraction's reports, exploited in the wild×3CVE-2025-49113Co-mentioned with UNK_MassTraction in 1 Signalis report (co-mention, not confirmed collaboration)×1unc5174Reports targeting EducationEducationUNK_MassTraction

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Education ×3
Victim regions
×2
×2
United States×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×3T1190 Exploit Public-Facing Application ×3T1555 Credentials from Password Stores ×3T1505.003 Web Shell ×3T1059.001 PowerShell ×2T1003 OS Credential Dumping ×2T1041 Exfiltration Over C2 Channel ×2T1071 Application Layer Protocol ×1T1070.001 Clear Windows Event Logs ×1T1082 System Information Discovery ×1T1219 Remote Access Software ×1T1047 Windows Management Instrumentation ×1

Indicators

cve ×6

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-42009 (exploited)CVE-2025-49113 (exploited)

Recent reports

High

China-linked hackers exploit Roundcube flaws to spy on U.S. and Canadian academic researchers

Bleeping ComputerCritical

China-Aligned Hackers Exploit Roundcube Flaws Against U.S. and Canadian Universities

The Hacker NewsHigh

China-aligned group exploited Roundcube vulnerabilities to breach U.S. and Canadian universities

CyberScoop

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans