Turla LightNeuron: An email too far – a first of its kind targeting Microsoft Exchange email servers

guest · May 7, 2019

Turla LightNeuron: An email too far
ESET research uncovers Microsoft Exchange malware remotely controlled via steganographic PDF and JPG email attachments
May 7, 2019
https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/

Recently, ESET researchers have investigated a sophisticated backdoor used by the infamous espionage group Turla, also known as Snake.

LightNeuron is, to our knowledge, the first malware specifically targeting Microsoft Exchange email servers. It uses a persistence technique never before seen: a Transport Agent. In the mail server architecture, it operates at the same level of trust as security products such as spam filters.

By leveraging the Transport Agent accesses, LightNeuron is able to:
• Read and modify any email going through the mail server.
• Compose and send new emails.
• Block any email. The original recipient will not receive the email.
Click to expand...

Steganography
LightNeuron uses steganography to hide its commands inside a PDF document or a JPG image. Thus, even if the email is intercepted, it might look legitimate, as it contains a valid attachment.
In conclusion
By leveraging a previously unseen persistence mechanism, a Microsoft Exchange Transport Agent, LightNeuron allows its operators to stay under the radar for months or years. It allows them to exfiltrate sensitive documents and control other local machines via a C&C mechanism that is very hard to detect and block.
Click to expand...

Research Paper: "Turla LightNeuron - One email away from remote code execution"
(PDF - 2.02 MB): https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf

Log in or Sign up

Turla LightNeuron: An email too far – a first of its kind targeting Microsoft Exchange email servers

guest Guest

Log in or Sign up

Turla LightNeuron: An email too far – a first of its kind targeting Microsoft Exchange email servers

guest Guest

Useful Searches