Thursday, April 18, 2024

Hackers Continue to Exploit Barracuda ESG Zero-Day Flaw: FBI Flash Alert

The recent discovery of a zero-day vulnerability (CVE-2023-2868) in Barracuda Networks Email Security Gateway (ESG) appliances has brought significant concern. 

CVE-2023-2868 is a remote command injection vulnerability that grants unauthorized execution of system commands with administrator privileges on Barracuda ESG appliances. 

Notably, this vulnerability affects ESG versions 5.1.3.001-9.2.0.006 in the appliance form factor. The vulnerability is exploited during the email attachment screening process. 

Cyber actors can format TAR file attachments in a specific manner and send them to an email address linked to a domain with an ESG appliance. 

This malicious attachment triggers a command injection, allowing the execution of commands within the ESG with its privileges. More details about Barracuda’s zero-day vulnerability can be found here.

Exploitation by Suspected PRC Cyber Actors

Evidence of the exploitation of Barracuda ESG appliances emerged in October 2022. 

Suspected PRC cyber actors utilized emails with malicious attachments to target victims. 

Initially, attachments had “.tar” extensions, later evolving to different formats like “.jpg” or “.dat.” 

Upon scanning, these files initiated a connection to a domain/IP controlled by the actors, establishing a reverse shell and enabling further commands on the ESG device. 

Following the compromise, actors injected various malicious payloads to gain persistent access, scan emails, harvest credentials, and exfiltrate data.

The vulnerability’s exploitation involves formatting malicious attachments to trigger command injection. 

Exploited ESG appliances remain at risk even after patches have been applied. The FBI urges immediate isolation and replacement of affected ESG appliances. 

The attackers’ advanced techniques include counter-forensics, making detection challenging. 

Networks must be scanned for connections to provide indicators of compromise.

The FBI released a list that includes domains and IP addresses utilized by the attackers for malicious activities through an investigation.

The cyber division of the FBI also published recommended Barracuda mitigations for this exploitation.

  • Remove all ESG appliances immediately.
  • Conduct scans for outgoing connections using provided indicators.
  • Investigate and revoke compromised credentials.
  • Revoke and reissue certificates present during the compromise.
  • Monitor the entire network for signs of data exfiltration and lateral movement.
  • Capture forensic images and conduct a thorough analysis.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Website

Latest articles

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...

Phishing-as-a-Service Platform LabHost Seized by Authorities

Authorities have dismantled LabHost, a notorious cybercrime platform that facilitated widespread phishing attacks across...

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles