In this urgent advisory, the speaker warns that Barracuda's physical Email Security Gateway appliances are vulnerable to a critical remote command injection flaw (CVE-2023-2868) that has been actively exploited since October 2022. Approximately 11,000 devices are deployed worldwide, with an estimated 5% showing compromise indicators. Attackers use malware families dubbed "Saltwater" and "Sea Spy" to establish deep, persistent backdoors that survive software patches, likely residing in firmware or the operating system. Barracuda's attempted patches have failed, leading the vendor to advise customers to power off, replace, or upgrade the devices immediately. The speaker outlines three immediate remediation steps: (1) shut down and replace the appliance, (2) reset and revoke all associated credentials and certificates (LDAP, AD, TLS, etc.), and (3) conduct a retrospective compromise investigation back to October 2022 using Barracuda‑provided YARA rules. The tone is urgent and the message stresses that failure to act could result in ongoing data exfiltration and persistent compromise.
Chapters
Barracuda email security gateway devices are being hacked and customers need to act immediately. Now, you know, the cybersecurity problem is serious when an enterprise security appliance is being compromised and software patches can't remedy that vulnerability. Leading to the vendor telling customers to discontinue or to upgrade the device. This is the situation Barracuda currently finds itself in. Their email security gateway device that is tasked with protecting users from malicious email is now being taken over by attackers with specially configured files to install malware and exfiltrate sensitive user data. Okay, so here's a quick rundown on the situation. This is all about vulnerability CVE-2023-2868, which is a critical remote command injection vulnerability, and this vulnerability has been actively exploited for at least 8 months going all the way back to October 2022. Barracuda brand email security gateways, the physical appliances, not their software version, not their cloud version, but their physical appliances that they've sold to customers are impacted, all of them. And there are no patches that work. There's no security patch to install that's going to protect you. That's why they're saying turn it off, get rid of it, please upgrade it, something to that effect. And right now it's estimated that there are about 11,000 devices worldwide. And again, this is something that an enterprise, a medium or large size enterprise, may have in their data center to protect their email. Now, Barracuda estimates about 5% of those active appliances, they've actually shown indicators of being compromised due to this vulnerability. And attackers can conduct a remote total takeover of the device. So this is bad. Barracuda tried to patch multiple times but ultimately failed to counter the attacks. At least two different pieces of malware floating around right now being used to exploit the vulnerability on these devices. Uh, one is called Saltwater, the other one is named Sea Spy. Essentially, they create backdoors on the gateway appliance that can be used to exfiltrate sensitive corporate data. And the strategic implications about this is really kind of frightening. Essentially, the attackers have gotten far enough down the stack through this vulnerability that they can remain persistent even if the vendor deploys software patches. That likely means they are embedded in the hardware, firmware, or so deep within the device operating system that they can't be evicted even by the manufacturer. Okay, so quick recommendations. Number one, if you own one of these devices, immediately rip it out, replace it, do something. Turn it off though. Do it now. Attacks are going on right now and potential victims are being hunted by the threat agents with this malware. Number 2, reset any credentials that were connected with this appliance. That might be LDAP or Active Directory. It might be your TLS certificate, certificates, whatever it is, revoke them and replace them because they too could be compromised. And number 3, you need to check for an actual compromise to your systems. And you have to look back as far as October 2022. Now, Barracuda has documented some YARA rules on their site to help you with this for your convenience. But ultimately, you may have a compromise you have to deal with. So take a look now, stop the bleeding, work on containment, do what you need to do. But if you don't look, you'll never know. And that could be a big problem. So overall, take this seriously if you have one of these email security appliances. And definitely move quickly.
