Loading story…
Barracuda disclosed that its Email Security Gateway appliances were compromised through CVE-2023-2868, a zero-day in the Amavis antivirus scanning module that improperly sanitized .tar file contents in email attachments, enabling remote command execution and full takeover of affected physical appliances. The flaw affected ESG versions 5.1.3.001 through 9.2.0.006, and Barracuda issued patch BNSF-36456; however, the company and outside researchers warned that patching alone was insufficient because attackers could maintain persistence after exploitation, leading Barracuda to advise customers to replace impacted hardware rather than simply update it.
Reporting from Mandiant, Rapid7, KrebsOnSecurity, The Record, and government advisories said the intrusions were linked to a China-backed espionage group and involved multiple backdoors and implants, including SALTWATER, SEASIDE, SEASPY, SEASPY v2, WHIRPOOL, and SEASPRAY. CISA highlighted the incident as evidence of persistent risk at the network edge, while responders urged organizations to rotate credentials, reissue certificates, hunt for indicators of compromise, investigate lateral movement, and assess possible data exfiltration from any exposed Barracuda ESG device.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Barracuda published a legal notice about the ESG vulnerability and the company's response. The notice served as a formal public reference for the incident and remediation guidance.
NACSA published an advisory warning of active exploitation of CVE-2023-2868 and summarizing associated malware, espionage activity, and remediation steps. The notice reiterated that compromised appliances should be replaced and that organizations should rotate credentials, reissue certificates, and investigate for lateral movement and exfiltration.
Rapid7 published technical analysis warning that CVE-2023-2868 could lead to total compromise of physical Barracuda ESG appliances. The report highlighted the severity of the flaw and the difficulty of trusting impacted hardware after exploitation.
Mandiant attributed the Barracuda ESG exploitation campaign to UNC4841, a China-nexus espionage actor. Reporting described deployment of backdoors including SALTWATER, SEASIDE, and SEASPY, along with theft of email data and SSL certificates.
A CISA order drew attention to the Barracuda ESG incident as an example of persistent risk from compromised network-edge devices. The action underscored concerns that patching alone may not remove attacker access from affected appliances.
Barracuda advised customers that compromised ESG appliances must be replaced immediately rather than trusted after patching. The company recommended discontinuing use of affected devices and contacting support for replacement hardware or virtual appliances.
Barracuda released patch BNSF-36456 to address CVE-2023-2868 on affected Email Security Gateway appliances. The patch was applied to impacted versions, but later guidance warned it was insufficient for already-compromised devices.
Barracuda stated it became aware of the vulnerability in May 2023 while it was being actively exploited. The issue affected ESG appliance versions 5.1.3.001 through 9.2.0.006.
CVE-2023-2868 in Barracuda Email Security Gateway appliances was exploited in the wild as early as October 2022. The flaw enabled remote command execution via crafted .tar file attachments processed by the Amavis module.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
barracuda.com
Open sourcenacsa.gov.my
Open sourcetherecord.media
Open sourcekrebsonsecurity.com
Open sourcerapid7.com
Open sourcekrebsonsecurity.com
Open sourcetherecord.media
Open sourcemandiant.widen.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released fixes for a maximum-severity vulnerability in *AsyncOS* (tracked as **CVE-2025-20393**, **CVSS 10.0**) affecting **Cisco Secure Email Gateway (SEG)** and **Secure Email and Web Manager (SEWM)** appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with **root** privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the **Spam Quarantine** feature, allowing crafted HTTP requests to trigger root-level command execution. Cisco and Cisco Talos attributed the exploitation activity to **UAT-9686**, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a **persistence mechanism** to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.
Jun 29, 2026
Multiple critical zero-day vulnerabilities have been exploited in Cisco security products, targeting both email security appliances and network firewalls. A China-linked APT, identified as UAT-9686, exploited a zero-day vulnerability (CVE-2025-20393) in Cisco email security appliances running AsyncOS, specifically when the Spam Quarantine feature is internet-accessible. This flaw allows attackers to gain root privileges, posing a severe risk to organizations relying on these appliances for email protection. In parallel, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software have been targeted by a separate espionage campaign, linked to the ArcaneDoor threat actor, exploiting multiple zero-days (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) to achieve unauthenticated remote code execution and persistent access, even after system reboots or upgrades. These campaigns have prompted emergency directives from CISA and highlight the ongoing threat to perimeter network devices. Attackers have leveraged these vulnerabilities to establish persistent footholds, manipulate device memory, and potentially pivot deeper into victim networks. The vulnerabilities affecting ASA and FTD firewalls were publicly disclosed and patched, but the email security appliance zero-day remains unpatched, increasing the urgency for organizations to review their exposure and apply mitigations where possible.
Jun 29, 2026
Cisco has confirmed that a sophisticated cyberattack campaign is actively targeting a subset of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS Software. The attackers are exploiting a critical vulnerability, tracked as CVE-2025-20393, which allows them to execute arbitrary commands with root privileges on affected systems. Cisco's investigation has revealed that the threat actors have deployed a persistence mechanism to maintain control over compromised appliances, and there are currently no available workarounds. Customers are strongly advised to follow Cisco's mitigation guidance to assess exposure and reduce risk. Cisco Talos has attributed this campaign to a Chinese-nexus advanced persistent threat (APT) group, tracked as UAT-9686. The attackers have deployed a custom Python-based backdoor called "AquaShell," along with additional tools for reverse tunneling and log purging, such as AquaTunnel and AquaPurge. The campaign has been ongoing since at least late November 2025 and primarily affects appliances with non-standard configurations exposed to the internet. The attack highlights the importance of securing management interfaces and promptly applying vendor-recommended mitigations to prevent further compromise.
Jul 23, 2026