State-Backed Hackers Escalate Attacks on Government Email Servers

Cyberattacks targeting government email servers have intensified in recent years, a trend that experts warn is expected to continue. This concern follows a recent breach involving a cyber-espionage group linked to China, which infiltrated the email servers of Belgium’s intelligence agency.

On February 26, the Belgian federal prosecutor confirmed an investigation into the cyberattack targeting the country’s State Security Service (VSSE). According to a report by Belgian newspaper Le Soir, the attackers accessed approximately 10% of the VSSE’s incoming and outgoing emails between 2021 and May 2023. While classified data remained secure due to external hosting, the breach may have compromised personally identifiable information (PII) of nearly half of the agency’s personnel.

The hackers reportedly gained access to VSSE’s email systems by exploiting a critical remote command injection vulnerability, CVE-2023-2868, found in Barracuda Networks’ Email Security Gateway (ESG) appliance. Following the discovery of this security flaw, Barracuda enlisted Google security subsidiary Mandiant to investigate.

Mandiant tracked the espionage campaign to October 2022, identifying the threat actor as UNC4841. The firm established with “high confidence” that the group was connected to the Chinese government. UNC4841 reportedly distributed emails embedded with malicious attachments designed to exploit CVE-2023-2868, targeting vari

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.