2023 · At least 16 countries

Barracuda's email gateways hacked by the emails they were scanning

From October 2022 crafted attachments broke into Barracuda's email security gateways as they scanned them. Barracuda told customers to replace affected devices.

Published · Sources checked · 2 min read

When
October 2022 to May 2023, disclosed 23 May 2023
Who
Organisations using the Barracuda Email Security Gateway, almost a third of them government agencies
Where
At least 16 countries
Way in
Emails carrying crafted TAR archive attachments, aimed at the scanner itself
Tactics
Malicious attachment exploiting the gateway, a spam-like look, spoofed sender domains
Loss or impact
Backdoors on compromised appliances. Barracuda advised replacing compromised appliances whatever their patch level

What happened

Barracuda's Email Security Gateway is an appliance that sits in front of an organisation's mail and scans every message before it reaches anyone. On 18 May 2023 Barracuda was alerted to unusual traffic coming from some of these appliances. The next day it identified the cause: a flaw in how the gateway handled TAR archive files, later published as CVE-2023-2868. It patched all appliances on 20 May and announced the problem on 23 May.

Barracuda brought in Mandiant to investigate. Mandiant found the earliest exploitation on 10 October 2022, more than seven months earlier. It attributed the campaign to a group it tracks as UNC4841 and suspected links to China. The victims were in at least 16 countries. Almost a third of the affected organisations that Mandiant identified were government agencies.

The email

Each attack was an email with a specially crafted TAR attachment. Early emails used a .tar extension. Later ones used .jpg or .dat, but the files were still TAR archives inside. Mandiant described the subjects and bodies as generic, often with poor grammar, and some still contained placeholder values. Mandiant read this as deliberate: the messages were meant to look like ordinary spam. Some spoofed sender addresses on domains that did not exist or were not in use.

No person had to open anything. The exploit fired when the gateway scanned the attachment. Once inside, the attackers installed backdoors that Mandiant named SALTWATER, SEASPY, SEASIDE and SUBMARINE, among others.

Why it worked

The attack turned a defence into the target. A mail gateway has to open and inspect every attachment it receives, from anyone. A flaw in that inspection gives an attacker a way in that requires no click, no trust and no mistake by a person. The spam-like look meant that anyone who did glance at a quarantined message would dismiss it as junk.

What it cost

Barracuda's advice went further than a patch. Its security notice told customers that compromised appliances must be replaced immediately, regardless of patch level, because the attackers could keep their access through the backdoors. Barracuda said only a subset of appliances showed signs of compromise. The US Cybersecurity and Infrastructure Security Agency published analyses of the backdoors. Mandiant judged the campaign to be espionage, so the full extent of what was read or taken is not public.

What would have helped

Barracuda found the intrusion through unusual network traffic. That is the lesson for any organisation running a security appliance. Watch what the appliance itself does, and treat it as a system that can be compromised like any other. Several layers of defence matter for the same reason. When one layer fails, the next one has to notice. The case is in this archive because it shows that email carries risk even when nobody opens it.

Sources

  1. ESG Vulnerability, Barracuda Trust Center, updated through 2023.
  2. Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China, Mandiant, 15 June 2023.
  3. Barracuda says hacked ESG appliances must be replaced immediately, Sergiu Gatlan, BleepingComputer, 7 June 2023.