International
The Morning Dev

Only the news worth knowing

‹
 
A69/100

Malware · high

Turla deploys Cereal malware to steal emails from government Exchange servers

Tier A · Patch today – Before you go home

Who’s exposed: Government Exchange servers in Kazakhstan and Romania

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild · Full takeover · Secrets exposed

The Brief

  • Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
  • The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
  • ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

The checklist behind the tier

Checklist · 5 of 10 yes
YesHits tech teamsJudgment: Microsoft Exchange is enterprise mail server software that IT teams run and are responsible for.
NoCore infrastructureJudgment: Exchange is a single vendor's enterprise product, not software nearly every team runs like OpenSSH or glibc.
YesPopular toolJudgment: Exchange is a widely deployed mainstream enterprise mail platform used by many organizations.
YesExploited in the wildThe Hacker News: Turla uses Cereal to break into victims' Exchange servers, a real campaign against governments.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept has been published.
NoRemote, no loginNo source says the initial access works over the network without credentials or user interaction.
YesFull takeoverThe Hacker News: Turla breaks into Exchange servers and deploys Cereal malware on them, implying code execution on the server.
YesSecrets exposedThe Hacker News: Turla uses Cereal to surreptitiously collect emails from government Exchange servers, so user data was stolen.
NoSupply chainNo source says a legitimate package, update, build pipeline or signing key was compromised.
NoNo fix yetNo source states whether Microsoft has released a patch for the access method used.

Timeline

  1. ESET findings on the Cereal malware used by Turla reported

  2. CyberScoop

    Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

  3. Help Net Security

    Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

  4. BleepingComputer

    Turla hackers use new Cereal malware to spy on govt Exchange servers

  5. The Hacker News

    Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

Full coverage · 4 sources

First seen · 4 sources · Full story page · How tiers are decided