Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server

Turla hacking team abuses a legitimate feature of the Exchange server in order to hide out and access all of the target organizations messages.

A well-known Russian nation-state hacking group has been infiltrating the Microsoft Exchange email servers of its targeted victims since at least 2014 via a custom backdoor.
Researchers at ESET say the so-called Turla group, aka Snake, has been hacking into victims Microsoft Exchange servers and planting its sophisticated LightNeuron backdoor malware for cyber espionage purposes. Turla accesses the email systems by abusing Exchange Servers legitimate Transport Agent feature, which lets other software from Microsoft as well as third parties operate with Exchange, including spam-filtering tools. The feature lets these other applications process email messages coming and going from Exchange.
The LightNeuron backdoor for Exchange specifically allows Turla attackers to read and modify email messages, create and send their own messages, and block messages to users at the victim organization, ESET said in new research it revealed today. Turla previously had been seen targeting Outlook email clients, an attack method ESET detailed last August.
Matthieu Faou, a malware researcher with ESET, says he believes this is the first case of malware specifically targeting Exchange servers. Its really similar to the Outlook backdoor, but it has access to all emails of the [victim] organization. Its focused on the main email server, he says.
And by employing Exchanges Transport Agent, the attackers can blend into the email environment. This feature is something generally used by security products, such as anti-spam, to integrate into Microsoft Exchange, Faou says.
Turlas LightNeuron backdoor also operates a rare command-and-control method that uses email JPEG and PDF attachments to transport the commands - hidden within the attachments using steganography. The attacker sends an email with the JPEG and PDF, and the content is decoded and decrypted by LightNeuron on the main Exchange server, Faou explains.
ESET found three victims of the LightNeuron attacks: a ministry of foreign affairs in Eastern Europe, a diplomatic organization in the Middle East, and an unidentified organization in Brazil. The Brazilian victim was discovered via a sample uploaded to VirusTotal, according to ESETs new report on the newly found Turla operation.
The victims were the regular, usual targets of Turla - diplomatic entities, Faou says.
LightNeuron uses a PowerShell script, called msinp.ps1, to install LightNeuron, and a remote administration tool, called IntelliAdmin, both of which were discovered on victim machines, according to ESET.
Security researchers at Kaspersky Lab have seen similar Exchange Server attacks and steganography-masked C2 activity by Turla, according to Kurt Baumgartner, a security researcher with Kaspersky. They are active, he says, noting that Kaspersky Lab has previously written about the latest twist in Turla attacks in private reports to clients. Their technical capabilities are impressive and they are really well-resourced ... They are a top-tier APT.
No Patch
And like other so-called living-off-the-land-style attacks that abuse legitimate tools and software in a victim organization, theres no software patch to prevent a LightNeuron backdoor attack. ESETs Faou Microsoft could add some measures, such as enforcing a digital signature from a Transport Agent, for example, to ensure its legitimacy. But if an attacker steals the Exchange servers admin privileges, theres not much even more layers of security for Exchange can do, he says.
Its not really a vulnerability. They are using legitimate functionality [of Exchange], he says.
Microsoft was not available for comment at the time of this posting.
If an organization gets hit with Turlas LightNeuron, recovery is complicated. Simply removing the two malicious files will break Microsoft Exchange, preventing everybody in the organization from sending and receiving emails. Before actually removing the files, the malicious Transport Agent should be disabled, ESET warned in its
report
on the attacks.
The problem, Faou says, is that Transport Agent is registered in the configuration of the server, so even if LightNeuron gets removed, Exchange will try to load it. If its unable to load the Transport Agent, it will totally break the main server so you cannot send or receive emails anymore, he says. You need to administer Transport Agent properly before removing the files. ESET details the proper removal process in a
whitepaper
it also published today.
Turla attackers first must steal credentials to the Exchange Server to install LightNeuron. So enabling multifactor authentication among user accounts can help thwart the attack. In addition, ESET recommends monitoring the main Exchange Server, including installing endpoint detection and response (EDR) tools or other security monitoring.
The bottom line is many organizations typically dont monitor when a new Transport Agent gets installed on the Exchange Server. Thats the main problem. Its a feature thats not very well-known, Faou says.
Meanwhile, ESET said code snippets of the Windows version of LightNeuron indicate that Turla also created a Linux variant of the backdoor.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server