US FBI Urges Action on Barracuda ESG Hacking

The U.S. FBI urged the removal of email security appliances made by Barracuda Networks in a Wednesday flash alert, injecting fresh urgency in a push to stymie what’s been called the broadest Chinese cyber spying campaign in years.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

The bureau says it determined that patches from Barracuda fixing a zero day vulnerability exploited by suspected Beijing hackers are ineffective.

“The FBI continues to observe active intrusions and considers all affected Barracuda ESG appliances to be compromised and vulnerable to this exploit,” the bureau’s cyber division states. The vulnerability is tracked as CVE-2023-2868.

“Barracuda customers should remove all ESG appliances immediately,” the warning also says.

Barracuda in early June urged owners of hacked Email Security Gateway appliances to immediately replace their equipment regardless of whether they had applied patches to fix the vulnerability. The advisory came after the company observed continued malicious activity on previously-compromised appliances, even after the application of patches.

A Barracuda spokesperson Wednesday evening told Information Security Media Group the company believes the FBI warning is consistent with its earlier guidance that only owners of previously hacked devices should replace their appliances. ISMG contacted the FBI for clarification.

Suspected Chinese hackers in a state-run cyberespionage operation compromised hundreds of organizations through the vulnerability in the popular email security appliance. Security researchers from Mandiant determined in June that attackers began exploiting the zero day in October, and possibly earlier. “This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer, said in a June statement (see: Chinese Hackers Exploit Barracuda ESG Zero-Day).

Barracuda issued its first security patch for on May 20 after detecting the hackers on May 19. The vulnerability allowed hackers to send a malicious TAR archive file resulting in a command injection into the appliance. The attack was triggered when the security appliance scanned the attachment.

Mandiant, brought in by Barracuda to investigate, linked the hack to Beijing with “high confidence” and attributed the campaign to a previously unknown Chinese threat actor newly dubbed UNC4841. The threat actor “has been deploying new and novel malware to a small subset of high-priority targets following the remediation of CVE-2023-2868,” said Kevin Mandia, CEO of Mandiant, in an emailed Wednesday statement.

Hackers responded to Barracuda’s patch by modifying its primary backdoor to evade detection. Dubbed Submarine, the updated backdoor “lives in a Structured Query Language (SQL) database on the ESG appliance,” the Cybersecurity and Infrastructure Security Agency said in an Aug. 18 advisory.

“This actor continues to show sophistication and adaptability through deep preparedness and custom tooling, enabling its global espionage operations to span across public and private sectors worldwide,” Mandia added.