UNC4841 Targeting Government Entities with Barracuda ESG 0day
By The Hivemind
Excerpt
Related Families: SKIPJACK, DEPTHCHARGE, FOXTROT, FOXGLOVE
Verticals Targeted: Government, Military, Defense, Aerospace, Technology, Telecommunications Executive Summary
UNC4841 was observed using CVE-2023-2868 to target entities in multiple
verticals, including government and military.
Key Takeaways
government and military.
FOXTROT/FOXGLOVE.
A small number of previously impacted victims may continue to be at risk.
The Campaign
UNC4841 Targeting Government Entities with Barracuda ESG
UNC4841 was observed using CVE-2023-2868 to target entities in multiple verticals, including The threat actors used the Barracuda ESG 0da…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by polyswarm.io on blog.polyswarm.io.
Mentioned in the excerpt3
More from polyswarm.io1
polyswarm.io · Web page · Added 28 Jul
Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
Executive Summary Multiple vendors have observed active exploitation of CVE-2025-55182, a critical remote code execution vulnerability in React Server Components and frameworks like Next.js. Multiple threat actors, including China-nexus and North Korea-nexus…
On the same topics
Mandiant (Google) · Web page · Published 25 Sep
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
Proofpoint · Web page · Published 15 Jul
TA488 Targets Zimbra Mailservers with Half-Click Exploits
By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…
bluecyber.hashnode.dev · Web page · Published 22 Jul
Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…
ransom-isac.com · Web page · Published 22 Apr
DragonBreath: Dragon in the Kernel
Dragoncore_k.sys & Zhengzhou 403 Network Technology Co., Ltd. 0-Day BYOVD Vulnerability | Shell Company Analysis | Dragon Breath APT-Q-27 | APT31 Personnel Nexus Field Value Report Date April 22, 2026 Authors Alex Necula, Ellis Stannard TLP Classification…