International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 67 · Tier A7 sources

Russian hackers compromised government email servers to steal NATO, EU correspondence

The Record ·

Russian hackers compromised government email servers to steal NATO, EU correspondence

The Brief · written from 7 sources

  • Russia-aligned Turla (aka Snake) is using a previously undocumented modular .NET toolset called Cereal, according to ESET researchers.
  • The malware was planted on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania.
  • Cereal copies selected email directly from the mail flow, and sources say Turla has used the toolset against governments over the past year.

Why it matters

Exchange servers at government bodies are being used to silently copy email, including correspondence with NATO and EU officials, so administrators running on-premises Exchange should treat mail-flow monitoring as a priority.

Who’s affected

  • Organizations running Microsoft Exchange servers
  • Government agencies in Kazakhstan and Romania
  • Teams responsible for NATO and EU correspondence security
  • #turla
  • #cereal-malware
  • #microsoft-exchange
  • #espionage
  • #email-interception

Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.

Read the full story at therecord.media ↗

Timeline

  1. ESET researchers publicly disclose the Cereal malware used by Turla against government Exchange servers

  2. CyberScoop

    Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

  3. Help Net Security

    Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

  4. BleepingComputer

    Turla hackers use new Cereal malware to spy on govt Exchange servers

  5. The Hacker News

    Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

  6. darkreading

    AI Makes Reverse Engineering Mainstream Software & Malware Far Easier

  7. The Record from Recorded Future News

    Russian hackers compromised government email servers to steal NATO, EU correspondence

  8. Security Affairs

    Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

Full coverage · 7 sources

How do you feel about this?

0 Comments