CVE-2023-7102

CVE-2023-7102 is a Barracuda ESG Appliance vulnerability caused by a vulnerable third-party library that allowed parameter injection. Affected versions span 5.1.3.001–9.2.1.001; Barracuda removed the vulnerable logic to fix the issue. No explicit exploitation details are provided in the available...

CVE-2023-7102 Remote Code Execution (RCE) Vulnerability

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic...

Barracuda Email Security Gateway Security Vulnerability

Barracuda Email Security Gateway is an email security gateway from Barracuda that manages and filters all inbound and outbound email traffic to protect organizations from email threats and data breaches. A security vulnerability exists in Barracuda Email Security Gateway versions 5.1.3.001 throug...

VulnCheck KEV: CVE-2023-7102

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic...

PT-2023-8145

Name of the Vulnerable Software and Affected Versions Barracuda ESG Appliance versions 5.1.3.001 through 9.2.1.001 Description The issue is related to a case of arbitrary code execution that resides within a third-party and open-source library named Spreadsheet::ParseExcel, used by the Amavis...

CISA Releases Malware Analysis Reports on Barracuda Backdoors

Updated September 7, 2023 CISA has published an additional malware analysis report associated with malicious Barracuda activity. The report provides analysis on the following malware samples: SUBMARINE – SUBMARINE is a backdoor that exploits a vulnerability on the target environment where the...

Attacks, Vulnerabilities and Actors 28 August to 3 September 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of six attacks executed, one vulnerability, and two different adversaries highlights...

Chinese Hacking Group Exploits Barracuda Zero-Day

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Chinese-linked hacking group, tracked as UNC4841, has prominently directed its efforts towards infiltrating and compromising various entities in recent attacks. These offensives were particularly...

Earth Estries' Espionage Campaign Targets Governments and Tech Titans Across Continents

A hacking outfit nicknamed Earth Estries has been attributed to a new, ongoing cyber espionage campaign targeting government and technology industries based in the Philippines, Taiwan, Malaysia, South Africa, Germany, and the U.S. "The threat actors behind Earth Estries are working with high-leve...

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom

A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway ESG appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign. Mandiant, which i...

FBI confirms Barracuda patch is not effective for exploited ESG appliances

In an FBI Flash about a Barracuda ESG vulnerability, listed as CVE-2023-2868, the FBI has stated that the patches released by Barracuda in response to this CVE were ineffective for anyone previously infected. Although both Barracude and Mandiant have already made this determination, the agency sa...

CISA Releases IOCs Associated with Malicious Barracuda Activity

CISA has released additional indicators of compromise IOCs associated with exploitation of CVE-2023-2868. CVE-2023-2868 is a remote command injection vulnerability affecting Barracuda Email Security Gateway ESG Appliance, versions 5.1.3.001-9.2.0.006. Malicious threat actors exploited this...

Urgent FBI Warning: Barracuda Email Gateways Vulnerable Despite Recent Patches

The U.S. Federal Bureau of Investigation FBI is warning that Barracuda Networks Email Security Gateway ESG appliances patched against a recently disclosed critical flaw continue to be at risk of potential compromise from suspected Chinese hacking groups. It also deemed the fixes as "ineffective"...

A week in security (July 31 - August 6)

Last week on Malwarebytes Labs: The end looms for Meta's behavioural advertising in Europe Microsoft Teams used in phishing campaign to bypass multi-factor authentication Film companies lose battle to unmask Reddit users FAQ: How does Malwarebytes ransomware rollback work? How to protect your...

Compromised Barracuda appliances equipped with persistent backdoors by attackers

The Cybersecurity and Infrastructure Security Agency CISA has published three malware analysis reports based on malware variants associated with the exploitation of a known vulnerability in Barracuda ESG appliances. The Common Vulnerabilities and Exposures CVE database lists publicly disclosed...

Hackers Deploy "SUBMARINE" Backdoor in Barracuda Email Security Gateway Attacks

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday disclosed details of a "novel persistent backdoor" called SUBMARINE deployed by threat actors in connection with the hack on Barracuda Email Security Gateway ESG appliances. "SUBMARINE comprises multiple artifacts — includin...

Barracuda Email Security Gateway < 9.2.0.008 Command Injection (CVE-2023-2868)

According to its self-reported version, the Barracuda Email Security Gateway on the remote web server is 9.2.0.008. It is, therefore, affected by a command injection vulnerability in the processing of .tar files that could allow a remote, unauthenticated attacker to execute arbitrary commands wit...

Barracuda Email Security Gateway Service Detection

Binary data barracudaemailsecuritygatewayservicedetect.nbin...

Exploit for Improper Input Validation in Barracuda Email_Security_Gateway_300_Firmware

CVE-2023-2868: Barracuda ESG Command Injection For full...

CISA Order Highlights Persistent Risk at Network Edge

The U.S. government agency in charge of improving the nations cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment. The directive comes amid a surge in attacks targeting previously unknown vulnerabilities in widely...