ESET Research: Russia-Aligned Turla Group Uses Novel Exchange Tool to Spy on EU, NATO Emails

ESET Research: Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails

ESET Research has uncovered a sophisticated, modular, tightly interconnected toolset, designed to run on Exchange servers of compromised entities for long-term cyberespionage.The Russia-aligned Turla APT group is behind the toolset; Turla is assessed to be part of Russia’s FSB.ESET observed…

Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report.

Turla hackers use new Cereal malware to spy on govt Exchange servers

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]

Turla's Cereal malware turns victims' Exchange servers into spy hubs

Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal. The toolset doesn’t need an attacker-owned server. Operators send commands to the victim’s internet-facing Exchange server, dressed up as ordinary Outlook Web Access, A…