UPDATE: On June 6, 2023, network security giant Barracuda Networks added an update to their advisory regarding a now-patched critical vulnerability in their Email Security Gateway (ESG) appliances. The action notice states that all Barracuda Networks ESG appliances must be decommissioned and physically replaced regardless of whether the customer has applied the software patches or not. The flaw, tracked as CVE-2023-2868, is a command injection vulnerability that is being exploited by attackers to conduct remote code execution (RCE). The action notice comes as a shock to customers and researchers alike, and although at this time the technical details of the exploit have not been published by Barracuda Networks, it implies that the deployed malware utilized by the threat actor is able to persist on the compromised devices after they’ve been patched. Researchers state in their blog post that the exploitation attempts go back to at least November of 2022. The advisory makes note of several malware strains identified in this campaign, including trojanized backdoors like “Saltwater”, “SeaSpy”, and “Seaside”. Rapid7’s senior manager of vulnerability research stated that there is at least one (1) case of this exploit that indicates the threat actor may have exfiltrated data after compromising ESG appliances. At this time, impacted customers have already been notified that their appliances have been compromised through the software’s UI. CTIX analysts recommend that any organizations with impacted Barracuda products should take them offline and fully replace them through Barracuda Networks’ support. CTIX will continue to track this matter and may provide updates if further information becomes public.