CISA: 'Whirlpool' Backdoor Sends Barracuda ESG Security Down the Drain
Researchers have observed China's UNC4841 dropping the backdoor on Barracuda's email security appliances, in a spiraling cyber-espionage campaign.
August 10, 2023
![A blue water whirlpool A blue water whirlpool](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt460860b85b66d8af/64f17da207b849f726d86c9c/whirlpool-imageBROKER.com_GmbH_&_Co._KG-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The US Cybersecurity and Infrastructure Security Agency (CISA) this week issued yet another alert related to the recent advanced persistent threat (APT) attacks targeting a command-injection vulnerability in Barracuda's Email Security Gateway (ESG) appliances.
The alert pertains to a backdoor dubbed "Whirlpool" that the group behind the attacks — China-based UNC4841 — has been deploying in an aggressive cyber espionage campaign that stretches back to at least last October. So far, the campaign has affected private and public sector organizations across multiple industries in as many as 16 countries.
Barracuda first reported on the attacks in May after receiving reports of unusual activity related to its ESG appliances. The company's investigation showed UNC4841 targeting a then zero-day vulnerability in versions 5.1.3.011 to 9.2.0.006 of Barracuda ESG appliances. The threat actor was essentially using the vulnerability — tracked as CVE-2023-2868 — to gain initial access on systems belonging to a small number of targeted Barracuda customers.
Barracuda quickly issued a patch for the vulnerability. But by early June the company began urging affected customers to urgently replace infected systems rather than patch them, after observing UNC4841 actors take several measures to maintain a long-term presence on compromised systems.
Meanwhile, the attacks rage on.
The Whirlpool Backdoor
CISA identified Whirlpool as a backdoor that establishes a Transport Layer Security (TLS) reverse shell to the attacker's command-and-control (C2) server. Malicious traffic in these reverse shells can be hard to detect because the traffic is encrypted, and often blends in with normal HTTPS traffic.
Google's Mandiant security group first reported on Whirlpool in a June blog post, after Barracuda asked the company to investigate the ongoing ESG attacks.
The backdoor is one of several that UNC4841 has been using in its campaign. Mandiant's initial report listed three that the company discovered when investigating the Barracuda attacks: "Seaspray," "Seaside," and "Saltwater." Seaspray is the threat group's primary backdoor for the campaign, Saltwater is a module for Barracuda's SMTP daemon that contains backdoor functionality, and Seaside is a Lua-based module for the Barracuda SMTP daemon.
Austin Larsen, senior incident response consultant with Mandiant, says his company's analysis of the attacks showed UNC4841 actors are using Whirlpool alongside Seaspray and Seaside. "Whirlpool is a C-based utility," Larsen says. "[It] uses either a single CLI argument that is a given file path, or two arguments that are a given IP and port."
Unlike the other backdoors that UNC4841 has used so far in its campaign, Whirlpool is not a passive backdoor, Larsen says. The threat actor is using it instead to provide reverse shell capabilities for other malware families in its arsenal, such as Seaspray, he notes.
CISA also earlier in August flagged the use of the "Submarine" backdoor, which specifically obtains root privileges on an SQL database on Barracuda ESG appliances for a targeted subset of victims. The malware enables persistence, command-and-control, cleanup, and lateral movement on compromised networks, CISA warned. Mandiant, which helped CISA analyze the backdoor, described it as a manifestation of UNC4841's attempts to maintain persistent access on compromised systems after Barracuda issued a patch for CVE-2023-2868.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024