Security · High impactFan score 69 · Tier A4 sources

Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

Help Net Security · By Mirko Zorz · 2h ago

The Brief · written from 4 sources

Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

Who’s affected

Government organizations running Microsoft Exchange servers
Teams operating on-premises Exchange email infrastructure

#espionage
#turla
#microsoft-exchange
#malware
#email-security
#government

Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal…

Read the full story at helpnetsecurity.com ↗