Turla’s Cereal toolkit collects mail from compromised Exchange servers
Original title: New malware doesn’t call home, it turns your Exchange server into its home
ESET found no external command server; the passive backdoor waits on paths that resemble ordinary Outlook web traffic.
ESET describes Cereal, a modular toolkit that runs on compromised Microsoft Exchange servers, executes commands in memory and collects selected email. The victim server acts as the command point, and an injected module inspects mail in the transport pipeline. ESET attributes the activity to Russia-aligned Turla and says it has been used against targets in Kazakhstan and Romania, including mail tied to NATO and EU addresses. How the servers were first accessed is not described.
Unconfirmed: Initial access is unknown: ESET names no vulnerability, stolen credential or phishing email.
- CerealBox selects messages with .doc, .docx and .pdf attachments from chosen senders, recipients and subjects.
- Documented commands include full mailbox pulls, server-stored credentials and Active Directory queries.
- The backdoor listens on paths resembling Outlook Web Access, Autodiscover and ActiveSync.
- ESET says nothing new appears on disk while the in-memory mail hook copies selected messages.
Impact: Covert collection of email, credentials and directory data
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Migrate or retire on-premises Exchange where possible and treat remaining servers like tier-zero assets.
- 2.Limit internet exposure of Outlook Web Access and ActiveSync to what the business needs.
- 3.Hunt ESET indicators and unexpected code loading into Exchange’s transport process.
- Vendors
- Microsoft
- Threat actors
- Turla
- Countries
- KazakhstanRomaniaRussia
From the original article
5 min read at csoonline.com
There’s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders. A new report from global security company ESET describes a “sophisticated, modular, and tightly interconnected” toolset designed to run on compromised Exchange servers for long-term cyberespionage.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.