[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

research (ESET, Matías Porolli, WeLiveSecurity, Nov 10, 2026); attribution to Turla is ESET's, at high confidence

Hunt: Turla's "Cereal" toolset hides in Exchange, taking commands on OWA/Autodiscover/ActiveSync-like URL paths and hijacking transport agents in memory

  • Listener paths ESET observed: /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/ on 443. Check HTTP.sys URL reservations and IIS/HTTPERR logs for these prefixes; bad requests get redirected to an Exchange-like error page.
  • DLL hijack spots: CerealLoader dropped as ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\, loaded by WMI. Compare against known-good hashes.
  • Native image cache: malicious files named like Microsoft.Exchange.Search.Mdb.ni.dll planted in the .NET native image cache; one sample activates only under Exchange's search service. Look for NI images whose hashes don't match ngen output on a clean server.
  • Collection: CerealBox stages messages with .doc/.docx/.pdf attachments that match hardcoded sender, recipient, subject or filename lists into encrypted files on disk; commands also pulled mailboxes via EWS, queried AD, ran WMI and read LSA secrets.
  • ESET says IoCs are in its white paper and GitHub repository.

Sources: ESET WeLiveSecurity: Exchange for breakfast: Turla's Cereal tricks are not for kids (Nov 10, 2026) · ESET Research on X (thread, Nov 10, 2026)