Russian Nation-State Group Employs Custom Backdoor for Microsoft Exchange Server

A well-known Russian nation-state hacking group has been infiltrating the Microsoft Exchange email servers of its targeted victims since at least 2014 via a custom backdoor. 

Researchers at ESET say the so-called Turla group, aka Snake, has been hacking into victims' Microsoft Exchange servers and planting its sophisticated LightNeuron backdoor malware for cyber espionage purposes. Turla accesses the email systems by abusing Exchange Server's legitimate Transport Agent feature, which lets other software from Microsoft as well as third parties operate with Exchange, including spam-filtering tools. The feature lets these other applications process email messages coming and going from Exchange.

The LightNeuron backdoor for Exchange specifically allows Turla attackers to read and modify email messages, create and send their own messages, and block messages to users at the victim organization, ESET said in new research it revealed today. Turla previously had been seen targeting Outlook email clients, an attack method ESET detailed last August.

Matthieu Faou, a malware researcher with ESET, says he believes this is the first case of malware specifically targeting Exchange servers. "It's really similar to the Outlook backdoor, but it has access to all emails of the [victim] organization. It's focused on the main email server," he says.

And by employing Exchange's Transport Agent, the attackers can blend into the email environment. "This feature is something generally used by security products, such as anti-spam, to integrate into Microsoft Exchange," Faou says.

Turla's LightNeuron backdoor also operates a rare command-and-control method that uses email JPEG and PDF attachments to transport the commands - hidden within the attachments using steganography. "The attacker sends an email with the JPEG and PDF, and the content is decoded and decrypted by LightNeuron on the main Exchange server," Faou explains.

ESET found three victims of the LightNeuron attacks: a ministry of foreign affairs in Eastern Europe, a diplomatic organization in the Middle East, and an unidentified organization in Brazil. The Brazilian victim was discovered via a sample uploaded to VirusTotal, according to ESET's new report on the newly found Turla operation.

The victims were "the regular, usual targets" of Turla - diplomatic entities, Faou says.

LightNeuron uses a PowerShell script, called msinp.ps1, to install LightNeuron, and a remote administration tool, called IntelliAdmin, both of which were discovered on victim machines, according to ESET.

Security researchers at Kaspersky Lab have seen similar Exchange Server attacks and steganography-masked C2 activity by Turla, according to Kurt Baumgartner, a security researcher with Kaspersky. "They are active," he says, noting that Kaspersky Lab has previously written about the latest twist in Turla attacks in private reports to clients. "Their technical capabilities are impressive and they are really well-resourced ... They are a top-tier APT." 

No Patch
And like other so-called "living-off-the-land"-style attacks that abuse legitimate tools and software in a victim organization, there's no software patch to prevent a LightNeuron backdoor attack. ESET's Faou Microsoft could add some measures, such as enforcing a digital signature from a Transport Agent, for example, to ensure its legitimacy. But if an attacker steals the Exchange server's admin privileges, there's not much even more layers of security for Exchange can do, he says.

"It's not really a vulnerability. They are using legitimate functionality [of Exchange]," he says.

Microsoft was not available for comment at the time of this posting.

If an organization gets hit with Turla's LightNeuron, recovery is complicated. "Simply removing the two malicious files will break Microsoft Exchange, preventing everybody in the organization from sending and receiving emails. Before actually removing the files, the malicious Transport Agent should be disabled," ESET warned in its report on the attacks.

The problem, Faou says, is that Transport Agent is registered in the configuration of the server, so even if LightNeuron gets removed, Exchange will try to load it. "If it's unable to load the Transport Agent, it will totally break the main server so you cannot send or receive emails anymore," he says. "You need to administer Transport Agent properly before removing the files." ESET details the proper removal process in a whitepaper it also published today.

Turla attackers first must steal credentials to the Exchange Server to install LightNeuron. So enabling multifactor authentication among user accounts can help thwart the attack. In addition, ESET recommends monitoring the main Exchange Server, including installing endpoint detection and response (EDR) tools or other security monitoring.

The bottom line is many organizations typically don't monitor when a new Transport Agent gets installed on the Exchange Server. "That's the main problem. It's a feature that's not very well-known," Faou says.

Meanwhile, ESET said code snippets of the Windows version of LightNeuron indicate that Turla also created a Linux variant of the backdoor.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.