Security · High impactFan score 69 · Tier A4 sources

Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

The Hacker News · 2h ago

The Brief · written from 4 sources

Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

Who’s affected

Government organizations running Microsoft Exchange servers
Teams operating on-premises Exchange email infrastructure

#espionage
#turla
#microsoft-exchange
#malware
#email-security
#government

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET…

Read the full story at thehackernews.com ↗