The new trick. Exchange lets add-ons called transport agents hook into mail as it flows, for things like spam filtering. Turla has abused them before, but a registered agent shows up in Exchange's settings. The new module, CerealBox, skips that. It injects itself into EdgeTransport.exe, the process that moves mail, and wraps the handlers of agents that are already loaded in memory. Mail keeps arriving normally and nothing new appears in the configuration. ESET says hooking the transport service this way hasn't been documented for any malware family before.
What it took. CerealBox keeps messages that carry a .doc, .docx or .pdf attachment and match hardcoded lists of senders, recipients, subject words or file names. It compresses, encrypts and stages them on disk for the operators to pull later.
No outside command server. The main backdoor, CerealNeuron, sits on the Exchange server and waits for encrypted web requests on paths that look like normal Exchange traffic, such as /owa/sdds/ and /autodiscover/proxyservice/, per Help Net Security. Anything that isn't a valid command gets an ordinary Exchange error page. So the victim's own mail server is the command post, and there's no attacker domain or IP to block. Commands could pull mailboxes, query Active Directory, grab stored credentials, and read or delete files, BleepingComputer reports. Almost everything runs only in memory.
What isn't known. ESET couldn't tell how the attackers first got in, though the servers face the internet, so an exploited flaw is possible. It also couldn't say how much mail was taken.
Why buyers should care. Only two government victims are confirmed, but the method works on any on-prem Exchange server. If you still run one, check for unexpected code loaded into EdgeTransport.exe, look for odd hits on rarely used OWA and Autodiscover paths, watch for encrypted files piling up on mail servers, and run ESET's published indicators of compromise against your logs.