Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
,
Network Firewalls, Network Access Control
Hackers Reportedly Exploited Barracuda ESG Zero-Day
The Belgian government opened a probe into a suspected Chinese espionage campaign targeting the country’s civilian intelligence service.
See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware
Citing government sources, Le Soir reported Wednesday that Chinese hackers in November 2023 targeted the State Security Service by hacking email security appliances made by Barracuda Networks.
The hackers are suspected of accessing sensitive communications between the prosecutors’ office, police and ministers, as well as staff information, Le Soir reported.
The Belgian prosecutor’s office opened a probe into the hack on Wednesday, Reuters reported.
The attacks are suspected to be part of a wider campaign tied to a Chinese hacking group tracked as UNC4841 by Google Mandiant. The group, also known as Slime57, primarily targets government and technology organizations.
The campaign uncovered by Mandiant exploited a zero-day tracked as CVE-2023-2868 in the Barracuda Email Security Gateway beginning in October 2022. The attacks typically began with the hackers sending a phishing email containing malicious file attachments.
After Barracuda patched the flaw, the hackers altered their malware and employed additional persistence mechanisms in an attempt to maintain their access, Mandiant said. Google estimates hackers targeted victims in 16 different countries. The FBI in August 2023 warned that a patch for the flaw was ineffective and urged customers to remove from their network any previously hacked Barracuda appliance (see: FBI Urges Immediate Removal of Hacked Barracuda ESG Devices).
“Chinese hackers have had incredible success with similar zero-days in the last few years. Just one similar zero-day can be used to access hundreds of targets over several months without being noticed,” said John Hultquist, chief analyst at Google Threat Intelligence, about the campaign.
The attack on the Belgian government aligns with the broader Chinese strategy of compromising edge devices for stealth espionage campaigns. Chinese hackers have targeted Sophos, Microsoft Exchange Server, FortiClient and Ivanti edge device flaws.