Barracuda trades malware-affected ESGs for free

Barracuda News

Share post

Attackers recently exploited a vulnerability in Barracuda Email Security Gateways (ESG). In some cases, the attackers were able to place malware that is still active after an update. Barracuda informs affected customers and even replaces the ESGs free of charge.

In a statement, Barracuda explains the situation regarding security gaps and Email Security Gateway (ESG). The detailed vulnerability described is explained under CVE-2023-2868. The provided update is also recommended there. In addition, security specialist Mandiant investigated the incident and wrote an interesting blog post. In it, Mandiant lists the exploitation of the vulnerability and has discovered some links towards China.

UI notification

According to Barracuda, approximately 5 percent of active ESG appliances worldwide are affected by the vulnerability. Barracuda has traffic in mind for many ESGs. Despite the new update being active, some anomalies were found that indicate a malware infestation. With these devices, Barracuda uses the user interface to inform the owner to contact support. They will advise him there and help to exchange the ESG used. In this case, the exchange is even free of charge. If you haven't received a notification from Barracuda, relax. He should therefore not belong to the group of those affected.

As part of the investigation, Mandiant has identified a suspected China Nexus actor, currently known as UNC4841, targeting a subset of the Barracuda ESG Appliances to use as a vector for attacks against specific organizations and individuals. Mandiant believes there is a high probability that UNC4841 is the actor behind this targeted campaign, which is working in support of the People's Republic of China.

Many tracks lead to China

If customers have questions about the vulnerability or incident, they should contact [email protected] turn. However, Barracuda informs that the investigation is not yet complete.

More at


Via Barracuda Networks

Striving to make the world a safer place, Barracuda believes that every business should have access to cloud-enabled, enterprise-wide security solutions that are easy to purchase, implement and use. Barracuda protects email, networks, data and applications with innovative solutions that grow and adapt as the customer journey progresses. More than 150.000 companies worldwide trust Barracuda to help them focus on growing their business. For more information, visit


Matching articles on the topic

Report: 40 percent more phishing worldwide

The current spam and phishing report from Kaspersky for 2023 speaks for itself: users in Germany are after ➡ Read more

BSI sets minimum standards for web browsers

The BSI has revised the minimum standard for web browsers for administration and published version 3.0. You can remember that ➡ Read more

Data manipulation, the underestimated danger

Every year, World Backup Day on March 31st serves as a reminder of the importance of up-to-date and easily accessible backups ➡ Read more

Stealth malware targets European companies

Hackers are attacking many companies across Europe with stealth malware. ESET researchers have reported a dramatic increase in so-called AceCryptor attacks via ➡ Read more

IT security: Basis for LockBit 4.0 defused

Trend Micro, working with the UK's National Crime Agency (NCA), analyzed the unpublished version that was in development ➡ Read more

MDR and XDR via Google Workspace

Whether in a cafe, airport terminal or home office – employees work in many places. However, this development also brings challenges ➡ Read more

Test: Security software for endpoints and individual PCs

The latest test results from the AV-TEST laboratory show very good performance of 16 established protection solutions for Windows ➡ Read more

FBI: Internet Crime Report counts $12,5 billion in damage 

The FBI's Internet Crime Complaint Center (IC3) has released its 2023 Internet Crime Report, which includes information from over 880.000 ➡ Read more