{"id":10388,"date":"2026-11-11T04:55:07","date_gmt":"2026-11-11T04:55:07","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10388"},"modified":"2026-11-11T04:55:07","modified_gmt":"2026-11-11T04:55:07","slug":"new-malware-doesnt-call-home-it-turns-your-exchange-server-into-its-home","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10388","title":{"rendered":"New malware doesn\u2019t call home, it turns your Exchange server into its home"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

There\u2019s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders.<\/p>\n

A new report<\/a> from global security company ESET describes a \u201csophisticated, modular, and tightly interconnected\u201d toolset designed to run on compromised Exchange servers for long-term cyberespionage.<\/p>\n

The malware is named \u2018Cereal\u2019 because it relies heavily on serialization, a technique used to package data and code for transport. It comprises a novel Exchange email collection module, a sneaky command and control (C&C) mechanism, and clever .NET execution tricks.<\/p>\n

While as of now, it is being used by nation-state actors to attack government bodies<\/a>, enterprises should still be concerned.<\/p>\n

\u201cTradecraft like this tends not to stay with its inventors,\u201d said Frank Dickson<\/a> of Dickson Research, citing a baseball analogy: \u201cCriminal groups study nation-state techniques the way minor leaguers study a big league pitcher\u2019s grip. What works in the majors eventually shows up in every ballpark.\u201d<\/p>\n

Sophisticated tradecraft<\/h2>\n

ESET describes Cereal as a malware toolkit that runs on Microsoft Exchange servers, receives commands and executes them in memory, maps the victim organization, and collects selected email messages. No external network infrastructure was identified; instead, the toolkit contains a passive backdoor that runs on targeted servers and provides access. It leaves little on disk.<\/p>\n

The researchers noted that one of the most interesting aspects of the toolkit is what they did not find: External C&C infrastructure. The victim\u2019s compromised Exchange server is effectively \u201cco-opted\u201d to play the part.<\/p>\n

Operators send commands as separate, but similarly-structured, executables, suggesting an automated framework. An automated email collection module is injected into legitimate Microsoft Exchange processes, allowing threat actors to access and manipulate the email transport pipeline, the researchers explained.\u00a0 <\/p>\n

\u201cThis requires deep understanding of the inner workings of Microsoft Exchange and is a novel technique,\u201d they wrote.<\/p>\n

They described a typical attack chain<\/a> this way: An official in a national government office sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, just as it should; nothing looks suspicious. But before the email departs, a piece of code quietly examines it, identifies whether it is interesting, and if it is, sets aside a copy to be forwarded to \u201cprying eyes.\u201d The original email continues on its way as usual.<\/p>\n

The toolset demonstrated that Exchange servers are not just mail servers, they are \u201cdurable collection points,\u201d internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft, the researchers noted. The transport pipeline reflects a level of investment in this type of technique that is \u201cuncommon even among sophisticated APT [advanced persistent threat] actors,\u201d they said.<\/p>\n

The researchers discovered that the malware has so far been used to target Kazakhstan and Romania. ESET attributes the toolkit to Russia-aligned APT group Turla.<\/p>\n

Attackers made a significant effort to remain undetected<\/h2>\n

Experts agreed that some of the most notable aspects of Cereal are the lack of a C2 channel and the effort the attackers made to stay in stealth mode.<\/p>\n

\u201cESET found no attacker-controlled server. None,\u201d Dickson noted. The victim\u2019s own Exchange server is the command center, and the backdoor waits for encrypted requests on web paths that look like ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.<\/p>\n

\u201cCereal never calls home. It is home,\u201d he said.<\/p>\n

This is dangerous because most network defenses watch for traffic leaving for a suspicious destination. But here, there is no destination to block and no server to take down. \u201cThe attackers walk in through the front door, dressed as Outlook,\u201d he noted.<\/p>\n

Then there is the mail hook: Legitimate transport agents in Exchange allow software to inspect mail as it flows. But Cereal injects itself into Exchange\u2019s mail process and wraps the agents already running in memory.<\/p>\n

Mail keeps flowing, but nothing new appears. \u201cIt is the postal carrier who steams open the envelope, copies the letter, and reseals it before delivery,\u201d Dickson said.<\/p>\n

A component dubbed CerealBox selects messages with .doc, .docx, and .pdf attachments from chosen senders, recipients, and subjects. In Romania, ESET discovered that it collected mail involving The North Atlantic Treaty Organization (NATO) \u00a0and EU addresses. This should concern enterprises, Dickson said; swap in your preferred targets: outside counsel, your acquisition target, or your regulator, to retrieve a contract, a deal memo, or a legal strategy.<\/p>\n

Further, the commands ESET documented include pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups, and computers. An Exchange server sits deep inside the identity fabric. It is an Achilles\u2019 heel because it is internet-facing, highly privileged, and complex. \u201cOwn it, and you hold the keys to the kingdom if you will,\u201d Dickson said.<\/p>\n

His advice: Migrate or retire on premises Exchange where possible. Treat whatever remains as a tier-zero asset, \u201cguarded like a domain controller.\u201d Limit internet exposure of Outlook Web Access and ActiveSync to what the business truly needs. Hunt with the indicators described by ESET. Watch for unexpected code loading into Exchange\u2019s transport process.<\/p>\n

But while the researchers\u2019 work is excellent because it maps what Turla did once inside an organization in \u201cremarkable detail,\u201d it does not say how Turla got onto those servers, Dickson pointed out. No vulnerability is named, and no stolen credential or phishing email is described.<\/p>\n

\u201cA burglar who leaves no fingerprints is impressive,\u201d said Dickson. \u201cA burglar whose way in remains unknown is a problem for every house on the street.\u201d<\/p>\n

\u2018A level above\u2019<\/h2>\n

And, said David Shipley<\/a>, CEO of Beauceron Security, we\u2019ve seen the gap between nation state hackers and criminals collapse over the past few years in terms of sophistication, in particular thanks to AI, but \u201cthen you see something like this, which is still a level above.\u201d<\/p>\n

Running on premises Exchange has been increasingly risky for years, he noted. For government, AI firms, finance, and other high-value targets, the risk of hosting on prem instead of using cloud-based versions continues to grow.<\/p>\n

However, it\u2019s worth noting that just having Microsoft host Exchange doesn\u2019t mean you\u2019re safe from nation-states, Shipley said. \u201cIt just raises the bar.\u201d Another key challenge with Exchange servers is Microsoft\u2019s own advice not to have anti-virus scanners looking in certain places like ExchangeTransport.exe, because doing so could create instability.<\/p>\n

\u201cThey basically told criminals where to hide and why it\u2019s good to hide there,\u201d he noted. \u201cNot that they can do much about it, but it points to a huge Catch-22.\u201d<\/p>\n

Another Catch-22: With the publication of this report and new ideas that will undoubtedly come from it, \u201cwe\u2019ll likely see criminal groups consider the value of this kind of technique in the future,\u201d Shipley noted.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

There\u2019s a new flavor of cereal on the table, but not the appealing kind, particularly for defenders. A new report from global security company ESET describes a \u201csophisticated, modular, and tightly interconnected\u201d toolset designed to run on compromised Exchange servers for long-term cyberespionage. The malware is named \u2018Cereal\u2019 because it relies heavily on serialization, a […]<\/p>\n","protected":false},"author":0,"featured_media":10389,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10388","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10388"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10388"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10388\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10389"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}