New malware doesn’t call home, it turns your Exchange server into its home

A new strain of malware called "Cereal" has been identified, which targets Microsoft Exchange servers to carry out cyberespionage. This sophisticated toolset, developed by an unknown nation-state actor, does not rely on an external command and control (C2) infrastructure, instead using the compromised Exchange server itself as its command center. The malware executes commands in memory, maps the victim organization, and collects specific email messages without leaving any trace on the disk.

Cereal's key features include a novel email collection module, a stealthy C&C mechanism, and .NET execution tricks. It targets specific emails based on sender, recipient, and subject, and injects itself into legitimate Microsoft Exchange processes, allowing threat actors to access and manipulate the email transport pipeline. The attackers demonstrated an exceptional understanding of the inner workings of Microsoft Exchange, making this a novel technique that is uncommon even among sophisticated APT actors.

The malware has been reported in use against Kazakhstan and Romania, attributed to Russia-aligned APT group Turla. Attackers took significant measures to avoid detection by using the victim's Exchange server as the command center, with the backdoor waiting for encrypted requests that look like ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.

The implications of this malware are severe, as it allows attackers to retrieve sensitive information such as entire mailboxes, credentials, and Active Directory data. For enterprises, this means that their internet-facing Exchange servers become an Achilles' heel, holding the keys to the kingdom if compromised. The researchers advise enterprises to migrate or retire on-premises Exchange where possible and limit internet exposure of Outlook Web Access and ActiveSync to minimize risk.