Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

2 IOCs

A technical analysis of the SALTWATER backdoor used in Barracuda 0-day vulnerability (CVE-2023-2868) exploitation

Cyber Geeks

Published June 26, 2023Original Report

Excerpt

Summary SALTWATER is a backdoor that has been used in the exploitation of the Barracuda 0-day vulnerability CVE-2023-2868 . It is a module for the Barracuda SMTP daemon called bsmtpd. The malware hooked the recv, send, and close functions using an open-source hooking library called funchook . The following functionalities are implemented: execute arbitrary commands, download and upload files, proxy functionality, and tunneling functionality. Technical analysis SHA256:…

Read the original report →

Attack Flow8 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1190

1/8

Exploit Public-Facing Application

ActionExploit Barracuda vulnerability

Exploitation of Barracuda 0-day vulnerability (CVE-2023-2868) to gain initial access.

Indicators of Compromise

Open the mindmap →

2 indicators

Type	Indicator	Confidence	Score	First Seen
CVE	CVE-2023-2868	High	Score 79/100	First seen Jun 2, 2026
SHA256	1c6cad0ed66cf8fd438974e1eac0bc6dd9119f84892930cb71cb56a5e985f0a4	Medium	Score 53/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…