China-backed hackers exploited Barracuda zero-day to target govt: Report

Security researchers have said that China-backed hackers are likely behind the mass-exploitation of a recently discovered security flaw in Barracuda Networks' email security gear, allowing attackers to remotely gain access to affected devices.

As a result, Barracuda has warned customers to remove and replace all affected devices.

According to a report by cybersecurity firm Mandiant, the hackers used the flaw to compromise hundreds of organisations, most likely as part of a Chinese government-backed espionage campaign.

Almost a third of identified affected organisations were government agencies.

According to the report, the security flaw was discovered in Barracuda's Email Security Gateway (ESG) appliances last month, which sit on a company's network and filter email traffic for malicious content.

Barracuda released patches and warned that hackers had been taking advantage of the flaw since October 2022, however, the company later advised customers to remove and replace affected ESG appliances regardless of patch level, implying that the patches failed or were unable to prevent the hacker's access.

The researchers attributed the hacks to UNC4841, an unclassified threat group that shares infrastructure and malware code with other China-backed hacking groups.

According to the researchers, the threat group used the Barracuda ESG flaws to deploy custom malware that allows the hackers to maintain access to the devices while exfiltrating data.

Moreover, the report said that the threat actor UNC4841 "searched for email accounts belonging to individuals working for a government with political or strategic interest to (China) at the same time that this victim government was participating in high-level, diplomatic meetings with other countries".

Further, the researchers stated that the large proportion of government entities among the targets supports their assessment that the threat group has an intelligence-gathering motivation, rather than conducting destructive data attacks.

--IANS

shs/svn/