Ankura CTIX FLASH Update - August 1, 2023

Malware Activity

CISA Discloses Details of Previously Unknown Backdoor "SUBMARINE" Impacting Recently Exploited Barracuda Appliance

UPDATE: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert on July 28, 2023, regarding three (3) new malware reports in association with the exploitation of CVE-2023-2868 affecting the Barracuda Email Security Gateway (ESG) Appliance. CVE-2023-2868 (which has a CVSS score of 9.8/10) is a remote-control injection vulnerability that was exploited in October 2022 as a zero-day flaw. The alert noted that the threat actor responsible exploited the vulnerability to "gain initial access to victim systems and then implanted backdoors to establish and maintain persistence." Previous to the alert, researchers have detailed that UNC4841, a suspected China-affiliated espionage actor, is believed to have exploited the Barracuda vulnerability in 2022. Three (3) malware variants were detailed in the alert, but one