Threat video1:00
Turla Cereal .NET Toolset Hits Exchange: Detection & IOCs
Turla's Cereal .NET toolset runs in memory on government Exchange servers with no external C2 observed. 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for Turla Cereal .NET Toolset Hits Exchange: Detection & IOCs →
Chapters
- 0:00The hookTurla deployed Cereal on Exchange.
- 0:04The storyGovernment Exchange servers in Kazakhstan and Romania.
- 0:10Attack pathTurla's loader hid in Windows.
- 0:22AttributionAttributed to Turla.
- 0:26Indicators of compromise3 indicators to hunt: 2 file names and 1 path.
- 0:32MITRE ATT&CK techniques13 ATT&CK techniques, from execution to command and control.
- 0:37Remediation4 steps now: Hunt Exchange servers for ncobjapi.dll and wbemcomn.dll in C:\Windows\System32\wbem\.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Turla deployed Cereal on Exchange.
0:05Government Exchange servers in Kazakhstan and Romania.
0:10Turla's loader hid in Windows.
0:12Then it ran inside Exchange processes.
0:15Matched mail was staged, then exfiltrated.
0:22Attributed to Turla. Confidence: high.
0:273 indicators to hunt: 2 file names and 1 path.
0:3213 ATT&CK techniques, from execution to command and control.
0:374 steps now: Hunt Exchange servers for ncobjapi.dll and wbemcomn.dll in C:\Windows\System32\wbem\.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.