International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 67 · Tier A7 sources

Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

Security Affairs · By Pierluigi Paganini ·

Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

The Brief · written from 7 sources

  • Russia-aligned Turla (aka Snake) is using a previously undocumented modular .NET toolset called Cereal, according to ESET researchers.
  • The malware was planted on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania.
  • Cereal copies selected email directly from the mail flow, and sources say Turla has used the toolset against governments over the past year.

Why it matters

Exchange servers at government bodies are being used to silently copy email, including correspondence with NATO and EU officials, so administrators running on-premises Exchange should treat mail-flow monitoring as a priority.

Who’s affected

  • Organizations running Microsoft Exchange servers
  • Government agencies in Kazakhstan and Romania
  • Teams responsible for NATO and EU correspondence security
  • #turla
  • #cereal-malware
  • #microsoft-exchange
  • #espionage
  • #email-interception

ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on…

Read the full story at securityaffairs.com ↗

Timeline

  1. ESET researchers publicly disclose the Cereal malware used by Turla against government Exchange servers

  2. CyberScoop

    Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

  3. Help Net Security

    Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

  4. BleepingComputer

    Turla hackers use new Cereal malware to spy on govt Exchange servers

  5. The Hacker News

    Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

  6. darkreading

    AI Makes Reverse Engineering Mainstream Software & Malware Far Easier

  7. The Record from Recorded Future News

    Russian hackers compromised government email servers to steal NATO, EU correspondence

  8. Security Affairs

    Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

Full coverage · 7 sources

How do you feel about this?

0 Comments