Suspected state-backed Chinese hackers used a security hole in a popular email security appliance to break into the networks of hundreds of public and private sector organizations globally, nearly a third of them government agencies, including foreign ministries, cybersecurity firm Mandiant said Thursday.
“This is the broadest cyber espionage campaign known to be conducted by a China-nexus threat actor since the mass exploitation of Microsoft Exchange in early 2021,” Charles Carmakal, Mandiant’s chief technical officer, said.
The hack exploited a software vulnerability in Barracuda Networks’ Email Security Gateway, compromising tens of thousands of computers globally.
The hacking began on Oct. 10, 2022, but the intrusions were only discovered by Barracuda on May 19, 2023. Counter-measures were promptly taken….