Security News > 2023 > July > Hackers Deploy "SUBMARINE" Backdoor in Barracuda Email Security Gateway Attacks

The U.S. Cybersecurity and Infrastructure Security Agency on Friday disclosed details of a "Novel persistent backdoor" called SUBMARINE deployed by threat actors in connection with the hack on Barracuda Email Security Gateway appliances.

The findings come from an analysis of malware samples obtained from an unnamed organization that had been compromised by threat actors exploiting a critical flaw in ESG devices, CVE-2023-2868, which allows for remote command injection.

To that end, the infection chain involved sending phishing emails with booby-trapped TAR file attachments to trigger exploitation, leading to the deployment of a reverse shell payload to establish communication with the threat actor's command-and-control server, from where a passive backdoor known as SEASPY is downloaded for executing arbitrary commands on the device.

SUBMARINE, also codenamed DEPTHCHARGE by the Google-owned threat intelligence firm, is the latest malware family to be discovered in connection with the operation, which resides in a Structured Query Language database on the ESG appliance.

Worried about insider threats? We've got you covered! Join this webinar to explore practical strategies and the secrets of proactive security with SaaS Security Posture Management.

The agency further said it "Analyzed artifacts related to SUBMARINE that contained the contents of the compromised SQL database," and that it "Poses a severe threat for lateral movement."

News URL

https://thehackernews.com/2023/07/hackers-deploy-submarine-backdoor-in.html