Turla Deploys Cereal .NET Toolset to Intercept Email on Government Exchange Servers
The Russia-linked espionage group Turla (also tracked as Snake and Secret Blizzard, and linked by the article to Russia's FSB) has been running Cereal, a modular .NET toolset, on Microsoft Exchange servers of government bodies, as documented by ESET. ESET first found the toolset at a government body in Kazakhstan and later at a Romanian government agency, where the operators selectively copied email exchanged with NATO and EU representatives. The malware copies selected messages from the mail flow without registering a new transport agent or interrupting delivery, and it uses the compromised server itself as the only control point. Criticity is rated high because this is a targeted intrusion against government mail systems, but no CVE is involved and the article does not state how the attackers got in, which limits the immediate exposure for organisations outside these targets.
Detalhes técnicos
CerealBox injects into the Exchange EdgeTransport.exe process and wraps the handlers of transport agents already loaded in memory, so the malware inspects email content without adding a new transport agent (bleepingcomputer.com). It is configured to collect messages carrying .DOC, .DOCX or .PDF attachments that match sender, recipient or subject criteria (bleepingcomputer.com). CerealNeuron listens for encrypted web requests on paths that resemble Exchange services, such as /owa/sdds/ and /autodiscover/proxyservice/ (helpnetsecurity.com), decrypts them and runs the CerealRunner wrapper programs that carry the code the operators want executed. Those commands can retrieve email from Exchange, query Active Directory, extract credentials Windows stores locally, and read or delete files, and the output is encrypted and returned to the operators (bleepingcomputer.com). ESET observed no external command-and-control infrastructure and could not identify the IP addresses the operators connected from (helpnetsecurity.com). CerealHermit, a variant without network capabilities, reads encrypted command files from disk and likely serves as a fallback; ESET did not explain how the command files are placed or how results are retrieved (bleepingcomputer.com). The toolset abuses the .NET native image cache to run inside legitimate processes and keeps a small disk footprint (bleepingcomputer.com). ESET attributes Cereal to Turla with high confidence, citing a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com). ESET published an extended list of IoCs on its GitHub page, which was not opened for this record.
Linha do tempo
-
Turla Deploys Cereal .NET Toolset to Intercept Email on Government Exchange Servers
ler a análise desta fonte ocultar
The Russia-linked espionage group Turla (also tracked as Snake and Secret Blizzard, and linked by the article to Russia's FSB) has been running Cereal, a modular .NET toolset, on Microsoft Exchange servers of government bodies, as documented by ESET. ESET first found the toolset at a government body in Kazakhstan and later at a Romanian government agency, where the operators selectively copied email exchanged with NATO and EU representatives. The malware copies selected messages from the mail flow without registering a new transport agent or interrupting delivery, and it uses the compromised server itself as the only control point. Criticity is rated high because this is a targeted intrusion against government mail systems, but no CVE is involved and the article does not state how the attackers got in, which limits the immediate exposure for organisations outside these targets.
Technical Details
CerealBox injects into the Exchange EdgeTransport.exe process and wraps the handlers of transport agents already loaded in memory, so the malware inspects email content without adding a new transport agent (bleepingcomputer.com). It is configured to collect messages carrying .DOC, .DOCX or .PDF attachments that match sender, recipient or subject criteria (bleepingcomputer.com). CerealNeuron listens for encrypted web requests on paths that resemble Exchange services, such as /owa/sdds/ and /autodiscover/proxyservice/ (helpnetsecurity.com), decrypts them and runs the CerealRunner wrapper programs that carry the code the operators want executed. Those commands can retrieve email from Exchange, query Active Directory, extract credentials Windows stores locally, and read or delete files, and the output is encrypted and returned to the operators (bleepingcomputer.com). ESET observed no external command-and-control infrastructure and could not identify the IP addresses the operators connected from (helpnetsecurity.com). CerealHermit, a variant without network capabilities, reads encrypted command files from disk and likely serves as a fallback; ESET did not explain how the command files are placed or how results are retrieved (bleepingcomputer.com). The toolset abuses the .NET native image cache to run inside legitimate processes and keeps a small disk footprint (bleepingcomputer.com). ESET attributes Cereal to Turla with high confidence, citing a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com). ESET published an extended list of IoCs on its GitHub page, which was not opened for this record.