Hackers had been exploiting Barracuda zero-day since fall 2022

Hackers had been exploiting Barracuda zero-day since fall 2022

US-based email and network security solutions provider Barracuda Networks revealed that threat actors had been exploiting a recently patched zero-day vulnerability in its Email Security Gateway (ESG) appliances for nearly eight months to backdoor devices.

Tracked as CVE-2023-2868, the flaw is an OS command injection issue that can be exploited by a remote hacker to execute arbitrary Perl commands on the target system.

The vulnerability was identified on May 19 and a security patch to address the bug was applied to all ESG appliances worldwide on May 20, 2023. The vulnerability resided in a module which initially screens the attachments of incoming emails. Other Barracuda’s products, including SaaS email security services, are not affected.

While the investigation is still ingoing, the company found evidence indicating that said zero-day had been exploited since October 2022, with hackers installing malware on a subset of compromised devices. The attackers are also said to have exfiltrated data from impacted appliances.

An analysis showed that the attack involved three trojanized modules:

  • Saltwater - a trojanized module for the Barracuda SMTP daemon (bsmtpd) that contains backdoor functionality. The capabilities of Saltwater include the ability to upload or download arbitrary files, execute commands, as well as proxy and tunneling capabilities.

  • Seaspy - an x64 ELF persistence backdoor that poses as a legitimate Barracuda Networks service and establishes itself as a PCAP filter, specifically monitoring traffic on port 25 (SMTP). Seaspy also contains backdoor functionality that is activated by a "magic packet". Cybersecurity firm Mandiant found code overlap with a publicly available backdoor called ‘cd00r.’

  • Seaside - a Lua based module for the Barracuda SMTP daemon (bsmtpd) that monitors SMTP HELO/EHLO commands to receive a command and control (C2) IP address and port which it passes as arguments to an external binary that establishes a reverse shell.

Barracuda has shared Indicators of Compromise (IoCs) and Yara rules to help defenders hunt for this threat.

Back to the list

Latest Posts

Cyber Security Week in Review: July 4, 2025

Cyber Security Week in Review: July 4, 2025

In brief: Google patches Chrome 0Day, the US is on the hunt for North Korean IT workers, and more.
4 July 2025
AI chatbots fall for phishing scams

AI chatbots fall for phishing scams

The models provided the correct URL only 66% of the time; nearly 30% of responses pointed users to dead or suspended domains.
3 July 2025
Chinese hackers exploited Ivanti flaws in attacks against French government

Chinese hackers exploited Ivanti flaws in attacks against French government

ANSSI believes that the Houken campaign is operated by ‘UNC5174’, an entity believed to act as an initial access broker for China’s Ministry of State Security.
2 July 2025