UPDATE: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert on July 28, 2023, regarding three (3) new malware reports in association with the exploitation of CVE-2023-2868 affecting the Barracuda Email Security Gateway (ESG) Appliance. CVE-2023-2868 (which has a CVSS score of 9.8/10) is a remote-control injection vulnerability that was exploited in October 2022 as a zero-day flaw. The alert noted that the threat actor responsible exploited the vulnerability to “gain initial access to victim systems and then implanted backdoors to establish and maintain persistence.” Previous to the alert, researchers have detailed that UNC4841, a suspected China-affiliated espionage actor, is believed to have exploited the Barracuda vulnerability in 2022. Three (3) malware variants were detailed in the alert, but one (1) backdoor, dubbed “SUBMARINE” (and otherwise known as “DEPTHCHARGE”), was previously unknown. CISA explained that SUBMARINE is a “novel persistent backdoor” that contains various artifacts, “including a SQL trigger, shell scripts, and a loaded library for a Linux daemon”, that allow for execution with root privileges, command-and-control (C2), persistence, and cleanup. The agency also noted that the backdoor lives in a Structured Query Language (SQL) database on the ESG appliance and poses a severe threat for lateral movement. Additional details as well as indicators of compromise (IOCs) can be viewed in the alert linked below.