A component dubbed CerealBox selects messages with .doc, .docx, and .pdf attachments from chosen senders, recipients, and subjects. In Romania, ESET discovered that it collected mail involving The North Atlantic Treaty Organization (NATO) and EU addresses. This should concern enterprises, Dickson said; swap in your preferred targets: outside counsel, your acquisition target, or your regulator, to retrieve a contract, a deal memo, or a legal strategy.
Further, the commands ESET documented include pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups, and computers. An Exchange server sits deep inside the identity fabric. It is an Achilles’ heel because it is internet-facing, highly privileged, and complex. “Own it, and you hold the keys to the kingdom if you will,” Dickson said.
His advice: Migrate or retire on premises Exchange where possible. Treat whatever remains as a tier-zero asset, “guarded like a domain controller.” Limit internet exposure of Outlook Web Access and ActiveSync to what the business truly needs. Hunt with the indicators described by ESET. Watch for unexpected code loading into Exchange’s transport process.