SALTWATER
SALTWATER is a backdoor used by UNC4841 in exploitation of Barracuda Email Security Gateway (ESG) appliances, including attacks leveraging CVE-2023-2868 and later follow-on exploitation associated with CVE-2023-7102. It is implemented as a trojanized module for the Barracuda SMTP daemon (bsmtpd) and was deployed alongside other UNC4841 malware such as SEASPY and SEASIDE to establish persistence and maintain access on compromised appliances for extended periods.
Its core capabilities include arbitrary command execution, file upload and download, proxying, and tunneling. Technical analysis in the provided content states that SALTWATER hooks the send, recv, and close functions/syscalls using the open-source kubo/funchook library, obtaining original function addresses via dlsym and installing hooks during initialization. It intercepts socket activity, captures connection data, and spawns worker threads that connect to attacker-controlled VPS infrastructure over SSL/TLS. The malware exchanges structured 21-byte command messages with its C2 server and supports multiple functional channels identified as ShellChannel, DownloadChannel, UploadChannel, ProxyChannel, and TunnelArgs. ShellChannel executes attacker-supplied commands; DownloadChannel writes C2-supplied content to files on the device; UploadChannel exfiltrates files; ProxyChannel relays traffic through attacker-specified proxy endpoints; and TunnelArgs stores or clears remote IP and port parameters used for tunneling.
The content associates SALTWATER with UNC4841, which Mandiant assessed as likely China-nexus. UNC4841 was observed modifying SALTWATER-related components rapidly after Barracuda remediation efforts and using time-stomping to conceal deployment activity. Victimology in the provided material includes Barracuda ESG customers worldwide, with reporting noting impacts across government and private-sector organizations and specific reporting on compromise of Belgium's VSSE via Barracuda ESG. A cited analyzed SALTWATER sample has SHA256 1c6cad0ed66cf8fd438974e1eac0bc6dd9119f84892930cb71cb56a5e985f0a4.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SALTWATER is a backdoor that has been used in the exploitation of the Barracuda 0-day vulnerability CVE-2023-2868.
Barracuda later disclosed follow-on exploitation of CVE-2023-7102 in the Spreadsheet::ParseExcel library, again via malicious Excel attachments, to reinstall updated SEASPY and SALTWATER variants...
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"UNC4841 then deployed custom malware, including SALTWATER (a trojanized Simple Mail Transfer Protocol [SMTP] module enabling command execution and tunneling)..."
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Stealth
2 techniques
Stealth
Command and Control
5 techniques
Command and Control
“SALTWATER (a trojanized SMTP module enabling command execution and tunneling)… SEASIDE… turns SMTP HELO/EHLO data into reverse shells”
ProxyChannel... The first 4 bytes are used to construct the Proxy IP address... The binary creates a new SSL structure... initiates the TLS/SSL handshake with the Proxy server
DownloadChannel... The file name to be created is read using the MyReadAll function... The open64 routine is used to create the file on the device... The file is populated with content received from the C2 server
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trojanized SMTP module used on compromised Barracuda ESG appliances to enable command execution and tunneling (persistence/access and likely exfiltration support).
Custom implant described as a trojanized SMTP module on Barracuda ESG that enables command execution and tunneling, supporting persistence and data exfiltration from compromised email security gateways.
Custom implant for Barracuda ESG: a trojanized SMTP module used for command execution and tunneling, turning the email security gateway into a persistent access/exfiltration node.
SALTWATER is a backdoor malware deployed by Chinese APT UNC4841 after exploiting a zero-day in Barracuda Email Security Gateway appliances, used to maintain persistent access and facilitate espionage.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.