According to Mandiant, a group of hackers known as UNC4841, alleged to be acting on behalf of the Chinese government, has been targeting enterprises in at least 16 different countries by exploiting a flaw in Barracuda Networks’ Email Security Gateway devices.
The flaw allows hackers to distribute malware-laced attachments that may exploit susceptible devices and acquire network access. It allows the hackers steal data, send malicious emails to other targets, or install additional malware once inside an organization’s network.
According to Mandiant, the hackers have been targeting businesses in a range of industries, including government, trade, and academia, since at least October. In certain situations, hackers were able to keep access to target networks even after Barracuda patched the flaw. The hackers introduced used new strains of malware to adapt and maintain their presence in the victim’s network.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an updated notice recommending firms to examine any indicators of penetration properly. Mandiant also advised that all impacted organizations replace infected devices and undertake rigorous network audits to uncover any residual hacker presence.
The sources for this piece include an article in Axios.
