New malware doesn’t call home, it turns your Exchange server into its home

Publisher excerpt From CSO Online

There’s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders. A new report from global security company ESET describes a “sophisticated, modular, and tightly interconnected” toolset designed to run on compromised Exchange servers for long-term cyberespionage. The malware is named ‘Cereal’ because it relies heavily on serialization, a technique used to package data and code for transport. It comprises a novel Exchange email collection module, a sneaky command and control (C&C) mechanism, and clever .NET execution tricks. While as of now, it is being used by nation-state actors to attack government bodies, enterprises should still be concerned. “Tradecraft like this tends not to stay with its inventors,” said Frank Dickson of Dickson Research, citing a baseball analogy: “Criminal groups study nation-state techniques the way minor leaguers study a big league pitcher’s grip. What works in the majors eventually shows up in every ballpark.” Sophisticated tradecraft ESET describes Cereal as a malware toolkit that runs on Microsoft Exchange servers, receives commands and executes them in memory, maps the victim organization, and collects selected email messages. No external network infrastructure was identified; instead, the toolkit contains a passive backdoor that runs on targeted servers and provides access. It leaves little on disk. The researchers noted that one of the most interesting aspects of the toolkit is what they did not find: External C&C infrastructure. The victim’s compromised Exchange server is effectively “co-opted” to play the part. Operators send commands as separate, but similarly-structured, executables, suggesting an automated framework. An automated email collection module is injected into legitimate Microsoft Exchange processes, allowing threat actors to access and manipulate the email transport pipeline, the researchers explained. “This requires deep understanding of the inner workings of Microsoft Exchange and is a novel technique,” they wrote. They described a typical attack chain this way: An official in a national government office sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, just as it should; nothing looks suspicious. But before the email departs, a piece of code quietly examines it, identifies whether it is interesting, and if it is, sets aside a copy to be forwarded to “prying eyes.” The original email continues on its way as usual. The toolset demonstrated that Exchange servers are not just mail servers, they are “durable collection points,” internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft, the researchers noted. The transport pipeline reflects a level of investment in this type of technique that is “uncommon even among sophisticated APT [advanced persistent threat] actors,” they said. The researchers discovered that the malware has so far been u…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.