By 
The Russian state-sponsored threat group Turla has begun utilising a new malware toolset known as 'Cereal'. This sophisticated tool is specifically designed to spy on government organisations by intercepting emails from Microsoft Exchange servers. Researchers at the cybersecurity firm ESET uncovered this troubling trend late last year, revealing a sophisticated level of cyber-espionage targeting sensitive communications.
The initial detection of the Cereal malware occurred at a government institution in Kazakhstan, where ESET identified the modular .NET malware integrated into Microsoft Exchange. Just a month later, the malware was discovered at a Romanian government agency, where it was observed gathering email correspondence selectively, particularly involving representatives from NATO and the European Union, demonstrating the threat's international scope.
ESET highlights that the attacks utilised a malware component named CerealBox, which is injected into the EdgeTransport.exe process of Exchange servers. This technique allows the hackers to hijack existing transport handlers and execute commands directly in memory. As a result, the malware can inspect email content without the need to introduce a new transport agent or disrupt standard email operations, a tactic that significantly enhances its stealth capabilities.
What makes Cereal particularly concerning is how it was engineered to collect messages strategically. The tool was observed to target emails containing specific file attachments—such as Microsoft Word and PDF documents—as well as meeting criteria related to sender, recipient, and subject lines. This tailored approach reflects a high level of sophistication in the attackers' methods.
Another significant component of the Cereal toolkit is known as CerealNeuron, which monitors incoming encrypted web requests on pathways that are made to appear legitimate, resembling normal Exchange services. Upon receiving these requests, CerealNeuron decrypts the commands and proceeds to execute the associated CerealRunner program. This wrapper program is crucial as it carries the code that the attackers aim to execute, which may encompass a range of malicious actions including retrieving emails, querying Active Directory for user details, or managing files on the server.
ESET analysts noted the sheer replication of similar binaries within Cereal, each compiled for distinct tasks. This suggests that the operators likely possess an internal mechanism for automating the compilation and packaging of commands. Such a structured approach reflects not only a well-developed malware ecosystem but also a clear understanding of the intricacies involved in cyber-espionage.
The CerealRunner components are deliberately crafted to execute in the memory of the host machine, ensuring that the malware remains hidden during its operations. Once the commands are executed, CerealNeuron encrypts the results and sends them back to the hackers, reinforcing the cycle of communication without exposure.
Interestingly, ESET discovered an additional variant of the malware named CerealHermit. Unlike its counterpart, CerealHermit lacks network functionalities and retrieves commands from encrypted files on the server's disk. This fallback mechanism is vital for maintaining operational capability should the primary command-and-control communication become compromised; however, specifics on how the attackers upload the necessary command files remain unclear.
The techniques used for concealing Cereal and its components reflect Turla's in-depth knowledge of .NET execution processes. They effectively exploit the .NET native image cache to operate within legitimate processes, a tactic that highlights their ongoing strategy for stealthy and long-term cyber-espionage.
ESET characterises the Cereal toolset as being purposefully designed for covert operations, maintaining a minimal disk presence while using infrastructure that reduces the likelihood of detection. To assist organisations in identifying potential breaches, ESET has made available an extended list of indicators of compromise (IoCs) on their GitHub page.
The implications of such sophisticated malware being used to target governmental institutions raise serious concerns about the security of sensitive information. As cyber threats continue to evolve and become increasingly complex, it is crucial for organisations to stay vigilant and implement robust security measures to deter such attacks and protect their data.
Source: bleepingcomputer.com
