SEASPY
SEASPY is a backdoor used by the China-nexus espionage actor UNC4841 in the Barracuda Networks Email Security Gateway (ESG) intrusion campaign. It was deployed on compromised Barracuda ESG appliances after exploitation of Barracuda zero-day vulnerabilities, including CVE-2023-2868 via malicious email attachments and later CVE-2023-7102 to reinstall updated variants. Reporting describes SEASPY as a backdoor masquerading as "BarracudaMailService" and triggered by specially crafted "magic packets." UNC4841 deployed SEASPY alongside SALTWATER and SEASIDE to establish presence and maintain access on Barracuda ESG appliances, in some cases for up to eight months.
Mandiant reporting cited in the content states UNC4841 rapidly modified SEASPY and related components after Barracuda remediation efforts in May 2023, including changes across multiple SEASPY components between May 22 and May 24, 2023. The actor persistently executed SEASPY on appliance reboot by adding execution of "/sbin/BarracudaMailService eth0" to "/etc/init.d/rc" and time-stomping the file, and later maintained persistence by inserting a SEASPY execution command into an update_version Perl script executed by the appliance. UNC4841 also deployed the SANDBAR Linux rootkit, which Mandiant assessed was likely intended to hide SEASPY when it was deployed under the name "BarracudaMailService."
The malware was associated with broad espionage activity against Barracuda ESG customers worldwide, including government and private-sector organizations across at least 16 countries. The content links the campaign to exfiltration of email-related data from compromised appliances, with staged archives created under /mail/tmp/ and exfiltrated over TLS using openssl s_client, although those exfiltration mechanics are described at the campaign level rather than attributed exclusively to SEASPY. High-confidence identifiers directly mentioned in the content include the masquerade name "BarracudaMailService," execution path "/sbin/BarracudaMailService eth0," and its use on Barracuda ESG appliances compromised by UNC4841.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
...UNC4841 exploited Barracuda ESG zero-day vulnerabilities... malicious email attachments to trigger remote command injection in the ESG attachment-scanning component (CVE-2023-2868)... Crafted .tar archives abused Perl’s qx operator to execute arbitrary system commands...
Barracuda later disclosed follow-on exploitation of CVE-2023-7102 in the Spreadsheet::ParseExcel library, again via malicious Excel attachments, to reinstall updated SEASPY and SALTWATER variants after initial remediation.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...SEASPY (a backdoor masquerading as BarracudaMailService triggered by “magic packets”)..."
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
3 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor described as magic-packet malware targeting Barracuda Networks Email Security Gateway appliances.
Backdoor implant on Barracuda ESG appliances that masquerades as a legitimate service and is activated via specially crafted network traffic (“magic packets”).
Custom backdoor used on Barracuda ESG; masquerades as a legitimate service and is triggered via specially crafted network traffic (“magic packets”) to provide covert access.
Custom backdoor used on Barracuda ESG appliances; masquerades as a legitimate service and is activated via specially crafted network traffic (“magic packets”) to maintain covert persistence.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.