US-based email and network security solutions provider Barracuda Networks revealed that threat actors had been exploiting a recently patched zero-day vulnerability in its Email Security Gateway (ESG) appliances for nearly eight months to backdoor devices.

Tracked as CVE-2023-2868, the flaw is an OS command injection issue that can be exploited by a remote hacker to execute arbitrary Perl commands on the target system.

The vulnerability was identified on May 19 and a security patch to address the bug was applied to all ESG appliances worldwide on May 20, 2023. The vulnerability resided in a module which initially screens the attachments of incoming emails. Other Barracuda’s products, including SaaS email security services, are not affected.

While the investigation is still ingoing, the company found evidence indicating that said zero-day had been exploited since October 2022, with hackers installing malware on a subset of compromised devices. The attackers are also said to have exfiltrated data from impacted appliances.

An analysis showed that the attack involved three trojanized modules:

• Saltwater - a trojanized module for the Barracuda SMTP daemon (bsmtpd) that contains backdoor functionality. The capabilities of Saltwater include the ability to upload or download arbitrary files, execute commands, as well as proxy and tunneling capabilities.

• Seaspy - an x64 ELF persistence backdoor that poses as a legitimate Barracuda Networks service and establishes itself as a PCAP filter, specifically monitoring traffic on port 25 (SMTP). Seaspy also contains backdoor functionality that is activated by a "magic packet". Cybersecurity firm Mandiant found code overlap with a publicly available backdoor called ‘cd00r.’

• Seaside - a Lua based module for the Barracuda SMTP daemon (bsmtpd) that monitors SMTP HELO/EHLO commands to receive a command and control (C2) IP address and port which it passes as arguments to an external binary that establishes a reverse shell.

Barracuda has shared Indicators of Compromise (IoCs) and Yara rules to help defenders hunt for this threat.