We rank vendors based on rigorous testing and research, but also take into account your feedback and our commercial agreements with providers. This page contains affiliate links.
Disclosure:
Professional Reviews

vpnMentor contains reviews that are written by our community reviewers. These take into consideration the reviewers’ independent and professional examination of the products/services.

Ownership

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, ZenMate, Private Internet Access, and Intego, which may be reviewed on this website.

Affiliate Commissions Advertising

vpnMentor contains reviews that follow the strict reviewing standards, including ethical standards, that we have adopted. Such standards require that each review will take into consideration the independent, honest and professional examination of the reviewer. That being said, we may earn a commission when a user completes an action using our links, at no additional cost to them. On listicle pages, we rank vendors based on a system that prioritizes the reviewer’s examination of each service, but also considers feedback received from our readers and our commercial agreements with providers.

Reviews Guidelines

The reviews published on vpnMentor are written by community reviewers that examine the products according to our strict reviewing standards. Such standards ensure that each review prioritizes the independent, professional and honest examination of the reviewer, and takes into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings we publish may also take into consideration the affiliate commissions we earn for purchases through links on our website.

Barracuda Zero-Day Vulnerability Exploited to Steal Data

Barracuda Zero-Day Vulnerability Exploited to Steal Data
Zane Kennedy Published on 31st May 2023 Cybersecurity Researcher

Barracuda Networks, a prominent network and email security vendor, disclosed that a zero-day vulnerability in its Email Security Gateway (ESG) appliances had been exploited for an extended period, resulting in the theft of sensitive data.

The vulnerability, tracked as CVE-2023-2868, remained undetected for at least seven months before being discovered and fixed earlier this month.

According to investigators at Barracuda, the zero-day exploit was first employed in October 2022 to set up backdoors into certain ESG appliances. This allowed cybercriminals to maintain persistent access to the compromised devices. Investigations have confirmed that data was pilfered from a number of these infiltrated appliances.

The security breach finally came to light on May 18th, when abnormal network activity originating from select ESG appliances was detected. Barracuda, in collaboration with cybersecurity firm Mandiant, promptly launched an investigation. Their efforts led to the identification of the vulnerability on May 18th, with immediate patching of all ESG appliances following suit. By May 21st, the attackers' access to the compromised devices had been effectively terminated.

In response to the breach, Barracuda has proactively reached out to impacted customers via the ESG user interface. The company has advised customers to ensure their appliances are up-to-date, discontinue the use of any compromised devices and request replacements, refresh all credentials associated with affected appliances, and scrutinize network logs for any indicators of compromise or connections from unfamiliar IP addresses.

During the course of the investigation, researchers uncovered several previously unknown strains of malware specifically designed to exploit compromised ESG appliances. Among them, a trojanized module for the Barracuda SMTP daemon named "SALTWATER" contained backdoor functionality, along with the ability to upload and download arbritary files, execute commands, and more.

Additionally, a strain known as "SEASPY," was found to monitor SMTP traffic. A third module, called "SEASIDE," monitored SMTP HELO/EHLO commands for the IP address and port of the threat actors command-and-control server, with which it establishes a reverse shell.

The situation prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2023-2868 to its list of known exploited vulnerabilities. Federal agencies utilizing ESG appliances have been urged to thoroughly examine their networks for any signs of intrusion resulting from this compromise.

About the Author

Zane is a Cybersecurity Researcher and Writer at vpnMentor. His extensive experience in the tech and cybersecurity industries provides readers with accurate and trustworthy news stories and articles. He aims to help individuals protect themselves through informative content and awareness of cybersecurity's crucial role in today's digital landscape.