ESET_Lightneuron_WP.pdf

This ESET whitepaper analyzes LightNeuron, a sophisticated backdoor attributed to the Turla APT that persists on Microsoft Exchange servers by registering a malicious Transport Agent and a companion 64-bit DLL. LightNeuron intercepts, modifies or blocks mail, executes commands hidden in steganographic PDF/JPG attachments, and exfiltrates data via Exchange pickup folders, making detection and remediation difficult; the report includes technical analysis, configuration/rule formats, IoCs (hashes and paths), MITRE ATT&CK mappings and recommended mitigation/clean-up steps.