hightestEmerging Threat
UNC4841 - Barracuda ESG Exploitation Indicators
Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.
linuxfile_event
2025-08-19
Emerging Threats
Actor2023
UNC4841 Barracuda ESG Zero Day Exploitation
6Rules
1References
1Folders
2025-08-19Latest
Summary
UNC4841 Barracuda ESG Zero Day Exploitation is tracked here as a threat actor, intrusion set, or campaign with 6 Sigma detections spanning 2023. Coverage centers on linux / process_creation, linux / file_event.
Related Detections
Search this threathightestEmerging Threat
UNC4841 - Download Compressed Files From Temp.sh Using Wget
Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
linuxprocess_creation
2023-06-16
hightestEmerging Threat
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
linuxprocess_creation
2023-06-16
hightestEmerging Threat
UNC4841 - Email Exfiltration File Pattern
Detects filename pattern of email related data used by UNC4841 for staging and exfiltration
linuxfile_event
2023-06-16
criticaltestEmerging Threat
UNC4841 - Potential SEASPY Execution
Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor
linuxprocess_creation
2023-06-16
References