China-backed hackers exploited Barracuda zero-day to target govt: Report
San Francisco
16-June-2023
Security researchers have said that China-backed hackers are likely behind the mass-exploitation of a recently discovered security flaw in Barracuda Networks' email security gear, allowing attackers to remotely gain access to affected devices.
As a result, Barracuda has warned customers to remove and replace all affected devices.
According to a report by cybersecurity firm Mandiant, the hackers used the flaw to compromise hundreds of organisations, most likely as part of a Chinese government-backed espionage campaign.
Almost a third of identified affected organisations were government agencies.
According to the report, the security flaw was discovered in Barracuda's Email Security Gateway (ESG) appliances last month, which sit on a company's network and filter email traffic for malicious content.
Barracuda released patches and warned that hackers had been taking advantage of the flaw since October 2022, however, the company later advised customers to remove and replace affected ESG appliances regardless of patch level, implying that the patches failed or were unable to prevent the hacker's access.
The researchers attributed the hacks to UNC4841, an unclassified threat group that shares infrastructure and malware code with other China-backed hacking groups.
According to the researchers, the threat group used the Barracuda ESG flaws to deploy custom malware that allows the hackers to maintain access to the devices while exfiltrating data.
Moreover, the report said that the threat actor UNC4841 "searched for email accounts belonging to individuals working for a government with political or strategic interest to (China) at the same time that this victim government was participating in high-level, diplomatic meetings with other countries".
Further, the researchers stated that the large proportion of government entities among the targets supports their assessment that the threat group has an intelligence-gathering motivation, rather than conducting destructive data attacks. - IANS
More Headlines
Prajwal Revanna Likely To Return On Friday, SIT To Take Him Into Custody At Bengaluru Airport
Godrej Family Peacefully Divides $5.7 Billion Empire, Ensuring Legacy Continues
I Don't Blackmail People With Pen Drives & CDs Like Kumaraswamy, Says Shivakumar
BJP's Neeraj Tripathi and Congress's Ujjwal Raman Singh Compete in Crucial Allahabad Seat
Himansh Verma: Former 19-Yr-Old Millionaire Who Built Navrattan A Billion Dollar Company
Prajwal Revanna Likely To Return On Friday, SIT To Take Him Into Custody At Bengaluru Airport
Godrej Family Peacefully Divides $5.7 Billion Empire, Ensuring Legacy Continues
I Don't Blackmail People With Pen Drives & CDs Like Kumaraswamy, Says Shivakumar
BJP's Neeraj Tripathi and Congress's Ujjwal Raman Singh Compete in Crucial Allahabad Seat
Himansh Verma: Former 19-Yr-Old Millionaire Who Built Navrattan A Billion Dollar Company