China-Linked Barracuda Email Gateway Attacks Leave Compromised Appliances at Risk

Suspected China-linked cyber actors exploited Barracuda Email Security Gateway (ESG) appliances through CVE-2023-2868, a remote command injection vulnerability affecting versions 5.1.3.001–9.2.0.006. Attacks observed as early as October 2022 used specially crafted TAR email attachments processed by the gateway, requiring no recipient interaction. Attackers established persistent access, searched email, harvested credentials, exfiltrated data and accessed other systems in victims’ networks. In August 2023, the FBI independently verified that previously exploited appliances remained at risk despite Barracuda’s patches and urged their immediate isolation and replacement. Australia’s cybersecurity agency also reported confirmed compromise of at least one Australian organisation.

Additional reporting in December 2023 identified exploitation involving the third-party Spreadsheet::ParseExcel library and CVE-2023-7101 and CVE-2023-7102, enabling arbitrary code execution on ESG appliances. Barracuda reported automatically deploying a security update to active appliances on December 21, followed by an additional patch for appliances showing indicators of compromise. Defenders should verify patch deployment, investigate updated indicators across their networks and monitor for continued compromise. For appliances compromised through CVE-2023-2868, patching alone should not be treated as recovery: the FBI recommended replacement, credential and certificate replacement, and forensic investigation, warning that attackers used counter-forensic techniques to conceal their activity.