Barracuda Urges Immediate Replacement of Vulnerable Email Security Appliances.

Barracuda Networks urged its Email Security Gateway (ESG) customers to replace affected appliances instead of patching them after discovering a zero-day vulnerability that allowed attackers persistent backdoor access to the devices. The company said the malware was identified on a subset of appliances, and evidence of data exfiltration was identified on some systems. Experts suggest that the malware was able to corrupt the underlying firmware that powers the ESG devices in some irreparable way, indicating a state actor. Barracuda advises customers to rotate any credentials connected to the appliance(s) and check for signs of compromise dating back to at least October 2022.