ESET research has uncovered LightNeuron, a Microsoft Exchange backdoor that can read, modify or block any email going through the mail server, and even compose new emails and send them under the identity of any legitimate user of the attackers\u2019 choice. The malware is remotely controlled via emails using steganographic PDF and JPG attachments.<\/p>\n\n\n\n
\u201cWe believe that IT security professionals should be made aware of this new threat,\u201d comments Matthieu Faou, the ESET malware researcher who conducted the research.<\/p>\n\n\n\n
LightNeuron has been targeting Microsoft Exchange mail servers since at least 2014. ESET researchers have identified three different victim organizations, among them a ministry of foreign affairs in an Eastern European country and a regional diplomatic organization in the Middle East.<\/p>\n\n\n\n
ESET researchers have collected evidence suggesting, with a high level of confidence, that LightNeuron belongs to the arsenal of the infamous espionage group Turla, also known as Snake. This group and its activities are extensively covered by ESET research.<\/p>\n\n\n\n
LightNeuron is the first known malware misusing the Microsoft Exchange Transport Agent mechanism. \u201cIn the mail server architecture, LightNeuron can operate at the same level of trust as security products such as spam filters. As a result, this malware gives the attacker total control over the mail server \u2013 and thus, over all email communication,\u201d explains Faou.<\/p>\n\n\n\n
To make incoming command and control (C&C) emails look innocent, LightNeuron uses steganography to hide its commands inside valid PDF documents or JPG images.<\/p>\n\n\n\n
The ability to control the email communication makes LightNeuron a perfect tool for stealthy exfiltration of documents, and also for controlling other local machines via a C&C mechanism that is very hard to detect and block.<\/p>\n\n\n\n
\u201cDue to security improvements in operating systems, kernel rootkits, the holy grail of espionage malware, often quickly fade away from the attackers\u2019 arsenal. However, the attackers\u2019 need persists for tools that can live in the target system, hunt for valuable documents and siphon them off, all without generating any suspicion. LightNeuron emerged as Turla\u2019s solution,\u201d concludes Faou.<\/p>\n\n\n\n
ESET researchers warn that cleaning LightNeuron from a network is no easy task: simply removing the malicious files does not work, as it would break the email server.<\/p>\n\n\n\n
\u201cWe encourage administrators to read the research paper in full before implementing a cleaning mechanism,\u201d advises Faou.<\/p>\n\n\n\n
The detailed analysis, including the full list of Indicators of Compromise and samples, can be found in the research paper Turla LightNeuron: One Email Away from Remote Code Execution and on GitHub.<\/p>\n","protected":false},"excerpt":{"rendered":"
ESET research has uncovered LightNeuron, a Microsoft Exchange backdoor that can read, modify or block any email going through the mail server, and even compose new emails and send them under the identity of any legitimate user of the attackers\u2019 choice. The malware is remotely controlled via emails using steganographic PDF and JPG attachments. \u201cWe […]<\/p>\n","protected":false},"author":2,"featured_media":1618,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"1","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[217],"class_list":["post-10712","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-eset","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n