Top cybersecurity threats for
June 2023

Top takeaways:

• A zero-day vulnerability was found in the Barracuda Email Security Gateway
• Mandiant subsequently discovered the bug was being exploited by an unknown Chinese threat actor
• Organizations are being urged to continue monitoring the threat from UNC4841

In early June, Barracuda Networks took the unusual step of urging all customers of its Barracuda Email Security Gateway appliance impacted by a recent zero-day vulnerability to replace the devices immediately, regardless of patch version. That followed efforts by the cybersecurity vendor to update the appliances on May 21. The reason became clear after Mandiant released new intelligence on the case, which it was brought in to help with. An aggressive and persistent state-linked Chinese actor had been exploiting the zero-day in an espionage campaign dating back to October 2022.

The Mandiant report named the unknown group UNC4841. It said that Barracuda decided to issue the call for customers to replace their appliances after the group switched malware and deployed new persistence mechanisms, following the issuing of the Barracuda update. UNC4841 stepped up its campaign from May 22-24, with "high frequency" operations targeting victims in 16 countries. A third were government agencies, but individual victims included well-known academics in Taiwan and Hong Kong and Asian and European government officials in Southeast Asia. Mandiant warned network defenders to continue monitoring for UNC4841 activity.