Hackers had been exploiting Barracuda zero-day since fall 2022

Hackers had been exploiting Barracuda zero-day since fall 2022

US-based email and network security solutions provider Barracuda Networks revealed that threat actors had been exploiting a recently patched zero-day vulnerability in its Email Security Gateway (ESG) appliances for nearly eight months to backdoor devices.

Tracked as CVE-2023-2868, the flaw is an OS command injection issue that can be exploited by a remote hacker to execute arbitrary Perl commands on the target system.

The vulnerability was identified on May 19 and a security patch to address the bug was applied to all ESG appliances worldwide on May 20, 2023. The vulnerability resided in a module which initially screens the attachments of incoming emails. Other Barracuda’s products, including SaaS email security services, are not affected.

While the investigation is still ingoing, the company found evidence indicating that said zero-day had been exploited since October 2022, with hackers installing malware on a subset of compromised devices. The attackers are also said to have exfiltrated data from impacted appliances.

An analysis showed that the attack involved three trojanized modules:

  • Saltwater - a trojanized module for the Barracuda SMTP daemon (bsmtpd) that contains backdoor functionality. The capabilities of Saltwater include the ability to upload or download arbitrary files, execute commands, as well as proxy and tunneling capabilities.

  • Seaspy - an x64 ELF persistence backdoor that poses as a legitimate Barracuda Networks service and establishes itself as a PCAP filter, specifically monitoring traffic on port 25 (SMTP). Seaspy also contains backdoor functionality that is activated by a "magic packet". Cybersecurity firm Mandiant found code overlap with a publicly available backdoor called ‘cd00r.’

  • Seaside - a Lua based module for the Barracuda SMTP daemon (bsmtpd) that monitors SMTP HELO/EHLO commands to receive a command and control (C2) IP address and port which it passes as arguments to an external binary that establishes a reverse shell.

Barracuda has shared Indicators of Compromise (IoCs) and Yara rules to help defenders hunt for this threat.

Back to the list

Latest Posts

Qantas alerts customers to potential data breach after third-party cyberattack

Qantas alerts customers to potential data breach after third-party cyberattack

Attackers accessed and exfiltrated data from the compromised platform.
2 July 2025
US sanctions Russian bulletproof hosting for supporting cybercrime

US sanctions Russian bulletproof hosting for supporting cybercrime

The sanctions target Aeza Group’s parent entity, subsidiaries, and four individuals linked to the company’s leadership and operations.
2 July 2025
US agencies warn of rising cyber threats from Iran-linked hackers

US agencies warn of rising cyber threats from Iran-linked hackers

Recent months have seen a notable uptick in activity from Iranian-linked hacktivists and government-affiliated threat groups.
1 July 2025