FBI Urges Immediate Removal of Patched Barracuda ESG Devices

The FBI urged the immediate removal of previously patched email security appliances made by Barracuda Networks in a Wednesday flash alert, injecting fresh urgency in a push to stymie what’s been called the broadest Chinese cyber spying campaign in years.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

The bureau says it determined that patches from Barracuda designed to fix a zero-day vulnerability exploited by suspected Beijing hackers are ineffective.

“The FBI continues to observe active intrusions and considers all affected Barracuda ESG appliances to be compromised and vulnerable to this exploit,” the bureau’s cyber division states. The vulnerability is tracked as CVE-2023-2868.

“Barracuda customers should remove all ESG appliances immediately,” the warning also says.

Barracuda in early June urged owners of hacked Email Security Gateway appliances to immediately replace their equipment regardless of whether they had applied patches to fix the vulnerability. The advisory came after the company observed continued malicious activity on previously compromised appliances, even after they were updated with security fixes.

A Barracuda spokesperson Wednesday evening told Information Security Media Group the company believes the FBI warning is consistent with its earlier guidance that only owners of previously hacked devices should replace their appliances. ISMG contacted the FBI requesting clarification.

Suspected Chinese hackers in a state-run cyberespionage operation have exploited the vulnerability in the popular email security appliance to compromise hundreds of organizations. Security researchers from Mandiant determined in June that attackers began exploiting the zero-day last October, and possibly earlier. “This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer, said in a June statement (see: Chinese Hackers Exploit Barracuda ESG Zero-Day).

Barracuda issued its first ESG security patch on May 20, after observing hack attacks on May 19. The vulnerability allowed hackers to send a malicious TAR archive file resulting in a command injection into the appliance. The security appliance scanning the attachment triggered the attack.

Mandiant, brought in by Barracuda to investigate, linked the hack to Beijing with “high confidence” and attributed the campaign to a previously unknown Chinese threat actor newly dubbed UNC4841. The threat actor “has been deploying new and novel malware to a small subset of high-priority targets following the remediation of CVE-2023-2868,” said Kevin Mandia, CEO of Mandiant, in an emailed Wednesday statement.

Hackers responded to Barracuda’s patch by modifying its primary backdoor to evade detection. Dubbed Submarine, the updated backdoor “lives in a structured query language (SQL) database on the ESG appliance,” the Cybersecurity and Infrastructure Security Agency said Friday in an advisory.

“This actor continues to show sophistication and adaptability through deep preparedness and custom tooling, enabling its global espionage operations to span across public and private sectors worldwide,” Mandia added.