← Back to Feed

MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors

CVE-2023-2868

September 7, 2023 · CISA Advisories · Severity: CRITICAL

This CISA Malware Analysis Report details five malware samples associated with the SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER backdoors. These backdoors were deployed on Barracuda Email Security Gateway devices compromised via CVE-2023-2868, a former zero-day vulnerability. The report provides technical analysis and indicators of compromise to aid in detection and response.

Key Takeaways

  • CISA analyzed five backdoor malware samples linked to Barracuda ESG exploitation.
  • Threat actors exploited CVE-2023-2868, a zero-day in Barracuda Email Security Gateway.
  • The report provides IOCs and analysis for SUBMARINE, SKIPJACK, SEASPRAY, and WHIRLPOOL backdoors.
☕ Buy a Coffee