iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In December 2023, attackers exploited CVE-2023-7102, an arbitrary code execution flaw in a third-party Excel parsing library used by Barracuda Email Security Gateway (ESG) appliances. Barracuda and Mandiant attributed the activity to UNC4841; reports described a limited number of government, IT, and high-tech organizations, mainly in the United States and Asia-Pacific (APJ), as targets. Barracuda said it automatically updated active appliances and that customers did not need to act at that time.
What happened in the Barracuda ESG zero-day campaign?
Barracuda disclosed the incident on December 24, 2023. The vulnerability, tracked as CVE-2023-7102, affected Spreadsheet::ParseExcel, a third-party library used by the ESG appliance’s Amavis virus scanner. Attackers sent specially crafted Excel email attachments to exploit the flaw and execute code.
SecurityWeek reported that UNC4841 was observed exploiting the vulnerability on December 20, while available evidence suggested the campaign may have started around November 30. Barracuda and Mandiant assessed the activity as continued operations by UNC4841, a China-nexus threat actor. The reported targets were a limited number of government, IT, and high-tech organizations, mainly in the US and APJ; the reporting does not establish a broader victim count or a precise total for this campaign.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat malware was reported?
SecurityWeek reported that the attackers deployed new variants of SeaSpy and SaltWater. These names matter because Barracuda ESG has been involved in a separate, earlier campaign with overlapping malware-family names. The shared names do not make the two incidents identical, and details from the earlier operation should not be assumed to describe the December 2023 exploitation.
#1 Best Overall
- Rack Mount Kit for Barracuda F12
- PERFECT FIT: You can assemble your firewall or switch onto the rack with existing screws from the appliance for a perfect fit into our custom cut-outs; All connections are easily accessible from the front providing a clean look
- KEEP IT COOL: Custom model airflow cut-outs ensures that the hardware does not overheat by giving it all the breathing room it needs
- POWER: A fixed power supply secures the appliance from falling or shifting
- Product Dimensions: 2.32 in. x 18.98 in. x 8.54 in.; 1.3U/2U; Weight: 4 lbs; Part Number: RM-BC-T2
What did Barracuda do, and did customers need to act?
Barracuda said it automatically applied a security update to all active ESG appliances on December 21, 2023. On December 22, it deployed a separate patch for appliances that showed indicators of compromise associated with the newly identified malware variants. In its December 24 notice, Barracuda said no customer action was required at that time and that its investigation was ongoing. That is the vendor’s instruction as stated in that notice, not a substitute for checking current guidance or an organization’s own incident-response requirements.
SecurityWeek quoted Austin Larsen, a Mandiant senior incident response consultant at Google Cloud, saying Barracuda had deployed updates to address both the vulnerability and appliances that may have been compromised by the new variants. Larsen also recommended that customers read Barracuda’s advisory and follow its guidance. See the SecurityWeek report for the full attributed comment.
Rank #2
- (Not 19V version. Someone may have bought it by mistake. Please Check For Compatibility With Your Unit. Thanks.) New Global 12V AC/DC Adapter Compatible with Barracuda NG NextGen Firewall F280 DNA1120A-X200 BNGF280a BNHW020 Integrated Security Appliance 12VDC 12.0V DC12V 12 Volts 12 V 12.0 VDC Power Supply Cord Cable Battery Charger Mains PSU
- Compatible with Barracuda F18 Revision B Firewall SCB-6988A-BC2 BNGF18B
- Compatible with Barracuda CloudGen Firewall F80B SCB-6988A-BC3 BNHW031 BNGF80B Security Appliance
- Tested Units. In Great Working Condition.
How this differs from the earlier Barracuda ESG incident
The December 2023 incident involved CVE-2023-7102 and crafted Excel attachments. It must be kept separate from the earlier campaign exploiting CVE-2023-2868, which involved crafted TAR attachments and began as early as October 10, 2022, according to Mandiant. Barracuda discovered that activity in May 2023 and began remediation later that month.
For the CVE-2023-2868 incident, Barracuda advised customers with impacted appliances to replace them regardless of patch level. That replacement advice is not established as an instruction for CVE-2023-7102. Barracuda’s December 2023 notice instead described automatic updates and said customer action was not required at that time. Organizations should match any response decision to the specific vulnerability, appliance status, and applicable vendor advisory rather than carry over instructions from the earlier event.
Rank #3
- Advanced Design, High Portability Brand New!
- Safe standard: FCC，CE, RoSH
- Replacement only, not original, but 100% compatible
- Tested Units. In Great Working Condition.
The broader figures sometimes associated with the earlier campaign also do not describe the December 2023 event. Mandiant reported activity across at least 16 countries and said almost a third of identified organizations in that earlier campaign were government agencies. Those numbers should not be presented as victim totals or proportions for CVE-2023-7102.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What SUBMARINE does—and does not—tell us
CISA analyzed SUBMARINE, a persistent backdoor with root privileges found on an ESG appliance compromised through the earlier CVE-2023-2868 vulnerability. The sources cited here do not establish that SUBMARINE was used in the December 2023 CVE-2023-7102 campaign. It should not be added to the malware list for this incident.
Quick Recap
Best Value
- Compatible with Barracuda NextGen Firewall F18 BNHW025 BNGF18a 9S9-S140-101 F80 BNGF80a 9S9-S140-108 F280 BNHW026 VPN Router Security Appliance 19VDC Power Supply Charger. replaces lost or damaged power cords for these classic models
- Input 100-240V AC, 50/60Hz; supports global voltage for international use; reliable performance for home or travel
- FCC approved and safety certified; built-in overcurrent protection (OCP); short-circuit protection (SCP); overvoltage protection (OVP) for safe use
- Durable and convenient design; offers extended reach and flexibility for daily use, ideal replacement for original power supply
- Includes 1 AC Adapter + 1 Power Cord; backed by 24-month exchange warranty for peace of mind
Rank #4
- (Not 12V version. Someone may have bought it by mistake. Please Check For Compatibility With Your Unit. Thanks.) New Global 19V AC/DC Adapter Compatible with Barracuda Firewall F280 Revision B BNGF280B BNHW026 VPN Router Security Appliance 19VDC 19.0V DC19V 19 Volts 19 V 19.0 VDC Power Supply Cord Cable Battery Charger Mains PSU
- Compatible with Barracuda F18 Revision A NextGen Firewall VPN Router Security Appliance BNHW025 BNGF18a 9S9-S140-101 9S9-S140-103 9S9-S140-107
- Compatible with Barracuda NextGen Firewall F80 4-Port 1 Gbps BNHW025 BNGF80a 9S9-S140-102 9S9-S140-108
- Tested Units. In Great Working Condition.
What organizations responsible for ESG appliances should take from this
- Identify which incident and vulnerability an instruction refers to: CVE-2023-7102 in December 2023 or the separate CVE-2023-2868 campaign.
- Consult Barracuda’s applicable advisory for current vendor guidance and confirm whether the appliance is active or has indicators of compromise.
- Do not infer that the earlier campaign’s replacement recommendation or CISA guidance for earlier malicious activity automatically applies to CVE-2023-7102.
- Follow current vendor instructions and the organization’s incident-response process if compromise is suspected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
