CybersecurityUpdated Yesterday

A compromised Exchange server served as Cereal’s command infrastructure

ESET says it found no external command-and-control infrastructure for Cereal. Instead, the compromised Exchange server could receive the tool’s commands, making the victim’s mail system part of its control infrastructure. A component called CerealNeuron passively listened for incoming web requests on paths that resembled ordinary Exchange traffic, rather than beaconing to its operator. That let the tool wait for requests that looked familiar instead of reaching outward to announce itself. ESET says the approach helped conceal the activity.

1 publisher1 report

Coverage started Yesterday