SiestaGraph: New implant uncovered in ASEAN member foreign ministry

Elastic Security Labs documents an active, sophisticated intrusion (REF2924) against an ASEAN foreign ministry where adversaries exploited internet-connected Microsoft Exchange servers to execute malware, export and exfiltrate targeted mailboxes (24 accounts), deploy IIS webshells and custom backdoors (SiestaGraph, DoorMe), leverage a vulnerable kernel driver, and perform extensive internal reconnaissance; the report provides malware analysis, IOCs, MITRE ATT&CK mappings, and detection/hunting guidance.