The US Cybersecurity and Infrastructure Security Agency (CISA) has recently published analysis reports on three malware families that were deployed in an attack exploiting a remote command injection vulnerability found in Barracuda Email Security Gateway (ESG). This article provides an in-depth overview of the vulnerability, the exploitation, the malware families involved, the targets, and the analysis reports shared by CISA.
Background on the vulnerability
The Barracuda Email Security Gateway, an email security solution, was found to have a critical vulnerability known as CVE-2023-2868, affecting versions 5.1.3.001 to 9.2.0.006 of the appliance. This flaw allowed cybercriminals to gain unauthorized access to the system, starting at least in October 2022.
Exploitation and Malware Families
The Barracuda ESG vulnerability was exploited by a Chinese state-sponsored cyberespionage group known as UNC4841. This group utilized the vulnerability to gain entry into victim networks, execute a reverse shell, and download custom backdoors to maintain persistence.
The malware families involved in the attacks include SeaSpy, SaltWater, and SeaSide custom backdoors, as well as the SandBar rootkit. Additionally, the attackers used trojanized versions of legitimate Barracuda Lua modules, known as SeaSpray and SkipJack.
Targets and Impact
The cyberattacks were not limited to a single region. Instead, they targeted victims in at least 16 different countries, including government officials and high-profile academics. This widespread targeting indicates the sophisticated nature of the attack and the intent to gather sensitive information.
Analysis reports by CISA
To mitigate the threat, CISA took a proactive approach and shared detailed analysis reports on the malware families involved in the attack. These reports provide a comprehensive understanding of the malware’s capabilities, behavior, and potential impact.
Detailed malware analysis
CISA’s analysis reports provide specific details regarding the malware samples obtained, which include the exploit payloads and reverse shell backdoors. The payload delivery method involves phishing emails with malicious attachments that, once opened, trigger the command injection and deploy the reverse shell.
The SeaSpy Backdoor and Submarine
Two notable malware components identified in the analysis reports are the SeaSpy backdoor and the Submarine persistent backdoor. SeaSpy operates as a backdoor, providing remote access to attackers, while Submarine — which executes with root privileges — ensures persistence within the compromised system.
Acquisition of Malware Samples
CISA’s efforts to investigate the cyberattack led to the acquisition of 14 malware samples. These samples represent the Barracuda exploit payloads and reverse shell backdoors used by the attackers.
Indicators of Compromise (IoCs) and YARA rules
CISA’s malware analysis reports include crucial information, such as indicators of compromise (IoCs) and YARA rules. These assist organizations in detecting and mitigating the threats associated with the Barracuda ESG vulnerability. IoCs and YARA rules allow for the identification of malicious activities and the implementation of effective security measures.
Conclusion and Recommendations
The exploitation of the Barracuda ESG vulnerability highlights the critical need for organizations to prioritize cybersecurity measures. It is crucial to promptly patch vulnerabilities within systems and ensure the implementation of robust security solutions.
To mitigate the risk associated with the Barracuda ESG vulnerability, organizations are advised to:
1. Apply the necessary security patches and updates provided by Barracuda Networks promptly.
2. Educate employees about the importance of cybersecurity hygiene, including awareness of phishing attacks.
3. Implement multi-factor authentication (MFA) to add an extra layer of security to the email system.
4. Continuously monitor network traffic for suspicious activities.
By following these recommendations and staying vigilant, organizations can significantly reduce the risk posed by cybersecurity threats.
The sharing of analysis reports by CISA helps raise awareness about the Barracuda ESG vulnerability and the associated malware families. This proactive approach by CISA enables organizations to take appropriate actions to protect their systems and data against cyber threats. It emphasizes the importance of collaboration between government agencies, security providers, and organizations to effectively combat cybercrime.