campaign · 1684454400000

Barracuda ESG Zero-Day Exploitation

Suspected Chinese state-sponsored actors exploited a zero-day in Barracuda Email Security Gateways.

What happened

Actors exploited CVE-2023-2868 to gain access to ESG appliances and exfiltrate data.

Technical mechanism

Remote command injection in the email attachment screening module.

Why it matters

A sophisticated espionage campaign that persisted even after initial patching, requiring hardware replacement.

Impact

Compromise of government and private sector networks globally.

Response

Barracuda issued patches and eventually recommended replacing affected hardware.

Defensive lessons

  • Edge devices are prime targets
  • Hardware replacement may be necessary after deep compromise

Evidence register

  1. CISA — Threat Actors Exploiting Barracuda Email Security Gateway (ESG) Vulnerability (verified)