Summary:
The cyberattacks targeting Barracuda Email Security Gateway (ESG) devices, reveal a complex web of malware and vulnerabilities. The attacks were initially linked to a suspected pro-China hacker group called UNC4841, who exploited a zero-day vulnerability (CVE-2023-2868) in Barracuda ESG appliances to breach the devices and steal data. The vulnerability was categorized as critical, with a high severity level than attacks, which started in October 2022.[/subscribe_to_unlock_form]
Summary:
The cyberattacks targeting Barracuda Email Security Gateway (ESG) devices, reveal a complex web of malware and vulnerabilities. The attacks were initially linked to a suspected pro-China hacker group called UNC4841, who exploited a zero-day vulnerability (CVE-2023-2868) in Barracuda ESG appliances to breach the devices and steal data. The vulnerability was categorized as critical, with a high severity level than attacks, which started in October 2022.[emaillocker id="1283"]
This initially prompted Barracuda to offer replacement devices instead of software updates. As part of the attacks, various malicious tools were deployed, including previously unknown malware called Saltwater and SeaSpy, along with a tool named SeaSide for establishing reverse shells to enable remote access. after the discovered of another malware variant named Submariner that was used in the attacks, residing in the SQL database of ESG devices. This variant provided threat actors root access, persistence, and command and control capabilities. Then it disclosed the discovery of yet another backdoor malware named 'Whirlpool.' This marked the third distinct backdoor used in the attacks on Barracuda ESG devices. Whirlpool is a 32-bit ELF file that establishes a Transport Layer Security (TLS) reverse shell, utilizing arguments passed from a module for communication.
Additionally, Barracuda had found SeaSpy, a persistent passive backdoor, on compromised ESG appliances. SeaSpy operated under the guise of a legitimate service and executed commands on behalf of threat actors.
Attacker campaign targeting Barracuda Email Security Gateway devices, critical vulnerabilities, and a range of sophisticated malware. The severity of the attacks led Barracuda to replace compromised devices, and the emergence of new backdoors like 'Whirlpool' underscores the ongoing challenges in securing digital infrastructure.
Threat Profile:
References:
The following reports contain further technical details:
[/emaillocker]