Observed incident

Barracuda traces cloud intrusion to a key left with a former AI vendor

Reported

Published here

What happened

An intruder used a still-valid key from a former vendor to access about ten Barracuda cloud accounts during November 1–2. The intruder read internal secrets and reached a system that stored credentials used to monitor customers’ connected services.

Parties and reporting

Where this happened

Platforms and supply chain. A provider, package, marketplace or repository was compromised. Affected customers are wherever its users are; the sources do not break them down by country. Explore the world map.

AI tools and systems: Barracuda Managed XDR integrations, Cloud and source-code credentials, Activity consistent with ARTEX

Outcome

Barracuda revoked credentials and notified customers whose integration keys had been within reach. On November 13 it confirmed that its cloud key had been in the vendor’s GitHub configuration file. It found no direct evidence that the intruder read customer integration credentials. The available logs could not rule that out.

Operating lesson

Retire vendor credentials when the work ends. Notified XDR customers should reissue their integration credentials and examine connected-service logs from November 1.

Evidence and limits

Barracuda says the observed behavior and naming patterns were consistent with ARTEX. That assessment does not identify the attacker, the former vendor or a particular model. November 10 is the first public advisory. The November 13 update was issued at 19:30 UTC.

Sources