Covered by 3 outlets — first reported by ESET WeLiveSecurity, Nov 10, 09:57 UTC
Exchange for breakfast: Turla’s Cereal tricks are not for kids
Summary
ESET Research says the Russia-aligned group Turla has been using a new toolset called Cereal on Microsoft Exchange email servers. ESET found it at two government organizations, one in Kazakhstan and one in Romania, where it copied selected email out of the mail flow. According to the research, operators send commands to the victim's own internet-facing Exchange server, disguised as ordinary Outlook Web Access, Autodiscover and ActiveSync traffic, so no attacker-owned server is needed.
AI summary by the SecurityTabs newsroom, checked against ESET WeLiveSecurity, Help Net Security, BleepingComputer. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
ESET WeLiveSecurityFirst report
Exchange for breakfast: Turla’s Cereal tricks are not for kids
ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks
Help Net Security
Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow.
BleepingComputer
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
Explained
The technology and terms in this story. Learn more