Turla uses Cereal malware to spy on government Exchange servers
ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.
1
Stories per day · 30 days
1 RSS
Relatedcereal7turla7espionage6email-collection3email-theft2kazakhstan2cyber-espionage1fsb1government1romania1
11 stories, newest first · one card per story
Stories tagged #microsoft-exchange
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
14
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to China's Integrity Technology Group.
9
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
The US offers up to $10 million for alleged Hafnium hacker Zhang Yu, still at large.
9
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
U.S. Offers $10 Million Reward for Chinese Hacker Who Tried to Steal COVID-19 Research
The U.S. offers up to $10 million for Zhang Yu, accused of MSS-directed theft of COVID-19 research.
2
Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Kaspersky reports the NightEagle espionage group (APT-Q-95) expanded from China-focused targets to Russian companies, backdooring Microsoft Exchange servers with GhostContainer using stolen VPN credentials.
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest
Huntress and the FBI recount a five-year manhunt for Silk Typhoon, from 88,000 Exchange backdoors to an arrest.