New malware doesn’t call home, it turns your Exchange server into its home

There’s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders. A new report from global security company ESET describes a “sophisticated, modular, and tightly interconnected” toolset designed to run on compromised Exchange servers for long-term cyberespionage. The malware is named ‘Cereal’ because it relies heavily on serialization, a technique used to package data and code for transport. It comprises a novel Exchange email collection module, a sneaky command and control (C&C) mechanism, and clever .NET execution tricks. While as of now, it is being used by nation-state actors to attack government bodies, enterprises should still be concerned. “Tradecraft like this tends not to stay with its inventors,” said Frank Dickson of Dickson Research, citing a baseball analogy: “Criminal groups study nation-state techniques the way minor leaguers study a big league pitcher’s grip. What works in the majors eventually shows up in every ballpark.” Sophisticated tradecraft ESET describes Cereal as a malware toolkit that runs on Microsoft Exchange servers, receives commands and executes them in memory, maps the victim organization, and collects selected email messages. No external network infrastructure was identified; instead, the toolkit contains a passive backdoor that runs on targeted servers and provides access. It leaves little on disk. The researchers noted that one of the most interesting aspects of the toolkit is what they did not find: External C&C infrastructure. The victim’s compromised Exchange server is effectively “co-opted” to play the part. Operators send commands as separate, but similarly-structured, executables, suggesting an automated framework. An automated email collection module is injected into legitimate Microsoft Exchange processes, allowing threat actors to access and manipulate the email transport pipeline, the researchers explained.  “This requires deep understanding of the inner workings of Microsoft Exchange and is a novel technique,” they wrote. They described a typical attack chain this way: An official in a national government office sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, just as it should; nothing looks suspicious. But before the email departs, a piece of code quietly examines it, identifies whether it is interesting, and if it is, sets aside a copy to be forwarded to “prying eyes.” The original email continues on its way as usual. The toolset demonstrated that Exchange servers are not just mail servers, they are “durable collection points,” internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft, the researchers noted. The transport pipeline reflects a level of investment in this type of technique that is “uncommon even among sophisticated APT [advanced persistent threat] actors,” they said. The researchers discovered that the malware has so far been used to target Kazakhstan and Romania. ESET attributes the toolkit to Russia-aligned APT group Turla. Attackers made a significant effort to remain undetected Experts agreed that some of the most notable aspects of Cereal are the lack of a C2 channel and the effort the attackers made to stay in stealth mode. “ESET found no attacker-controlled server. None,” Dickson noted. The victim’s own Exchange server is the command center, and the backdoor waits for encrypted requests on web paths that look like ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic. “Cereal never calls home. It is home,” he said. This is dangerous because most network defenses watch for traffic leaving for a suspicious destination. But here, there is no destination to block and no server to take down. “The attackers walk in through the front door, dressed as Outlook,” he noted. Then there is the mail hook: Legitimate transport agents in Exchange allow software to inspect mail as it flows. But Cereal injects itself into Exchange’s mail process and wraps the agents already running in memory. Mail keeps flowing, but nothing new appears. “It is the postal carrier who steams open the envelope, copies the letter, and reseals it before delivery,” Dickson said. A component dubbed CerealBox selects messages with .doc, .docx, and .pdf attachments from chosen senders, recipients, and subjects. In Romania, ESET discovered that it collected mail involving The North Atlantic Treaty Organization (NATO)  and EU addresses. This should concern enterprises, Dickson said; swap in your preferred targets: outside counsel, your acquisition target, or your regulator, to retrieve a contract, a deal memo, or a legal strategy. Further, the commands ESET documented include pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups, and computers. An Exchange server sits deep inside the identity fabric. It is an Achilles’ heel because it is internet-facing, highly privileged, and complex. “Own it, and you hold the keys to the kingdom if you will,” Dickson said. His advice: Migrate or retire on premises Exchange where possible. Treat whatever remains as a tier-zero asset, “guarded like a domain controller.” Limit internet exposure of Outlook Web Access and ActiveSync to what the business truly needs. Hunt with the indicators described by ESET. Watch for unexpected code loading into Exchange’s transport process. But while the researchers’ work is excellent because it maps what Turla did once inside an organization in “remarkable detail,” it does not say how Turla got onto those servers, Dickson pointed out. No vulnerability is named, and no stolen credential or phishing email is described. “A burglar who leaves no fingerprints is impressive,” said Dickson. “A burglar whose way in remains unknown is a problem for every house on the street.” ‘A level above’ And, said David Shipley, CEO of Beauceron Security, we’ve seen the gap between nation state hackers and criminals collapse over the past few years in terms of sophistication, in particular thanks to AI, but “then you see something like this, which is still a level above.” Running on premises Exchange has been increasingly risky for years, he noted. For government, AI firms, finance, and other high-value targets, the risk of hosting on prem instead of using cloud-based versions continues to grow. However, it’s worth noting that just having Microsoft host Exchange doesn’t mean you’re safe from nation-states, Shipley said. “It just raises the bar.” Another key challenge with Exchange servers is Microsoft’s own advice not to have anti-virus scanners looking in certain places like ExchangeTransport.exe, because doing so could create instability. “They basically told criminals where to hide and why it’s good to hide there,” he noted. “Not that they can do much about it, but it points to a huge Catch-22.” Another Catch-22: With the publication of this report and new ideas that will undoubtedly come from it, “we’ll likely see criminal groups consider the value of this kind of technique in the future,” Shipley noted.