Barracuda Zero-Day Vulnerability Exploited to Steal Data

Barracuda Networks, a prominent network and email security vendor, disclosed that a zero-day vulnerability in its Email Security Gateway (ESG) appliances had been exploited for an extended period, resulting in the theft of sensitive data.

The vulnerability, tracked as CVE-2023-2868, remained undetected for at least seven months before being discovered and fixed earlier this month.

According to investigators at Barracuda, the zero-day exploit was first employed in October 2022 to set up backdoors into certain ESG appliances. This allowed cybercriminals to maintain persistent access to the compromised devices. Investigations have confirmed that data was pilfered from a number of these infiltrated appliances.

The security breach finally came to light on May 18th, when abnormal network activity originating from select ESG appliances was detected. Barracuda, in collaboration with cybersecurity firm Mandiant, promptly launched an investigation. Their efforts led to the identification of the vulnerability on May 18th, with immediate patching of all ESG appliances following suit. By May 21st, the attackers' access to the compromised devices had been effectively terminated.

In response to the breach, Barracuda has proactively reached out to impacted customers via the ESG user interface. The company has advised customers to ensure their appliances are up-to-date, discontinue the use of any compromised devices and request replacements, refresh all credentials associated with affected appliances, and scrutinize network logs for any indicators of compromise or connections from unfamiliar IP addresses.

During the course of the investigation, researchers uncovered several previously unknown strains of malware specifically designed to exploit compromised ESG appliances. Among them, a trojanized module for the Barracuda SMTP daemon named "SALTWATER" contained backdoor functionality, along with the ability to upload and download arbritary files, execute commands, and more.

Additionally, a strain known as "SEASPY," was found to monitor SMTP traffic. A third module, called "SEASIDE," monitored SMTP HELO/EHLO commands for the IP address and port of the threat actors command-and-control server, with which it establishes a reverse shell.

The situation prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2023-2868 to its list of known exploited vulnerabilities. Federal agencies utilizing ESG appliances have been urged to thoroughly examine their networks for any signs of intrusion resulting from this compromise.