Turla’s Cereal toolset found on government Exchange servers
ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.
78
Malware
Cereal
- Mentions · 7d9
- Mentions · 30d9
- All mentions9
- First seenNov 10, 2026
- Last mentioned5h ago
Timeline
9 articles · newest firstTurla's Cereal toolset collects NATO and EU mail from government Exchange
ESET names government victims in Kazakhstan and Romania and says those servers served as command and control.
74
Turla uses Cereal malware to collect email from Exchange servers
ESET found the toolset at government organizations in Kazakhstan and Romania, with activity dating to late 2025.
76
Turla used Cereal malware to steal mail from two governments
ESET says Cereal hid in Microsoft Exchange and collected Romanian mail with NATO and EU officials.
76
Turla’s Cereal toolkit turns Exchange servers into surveillance platforms
ESET found the .NET toolset at government organizations in Kazakhstan and Romania and attributes it to Turla with high confidence.
74
Turla uses Cereal malware to steal email from government Exchange servers
ESET says the modular .NET toolset hit two government entities in Kazakhstan and Romania in late 2025, with no external C2.
76
Turla uses Cereal malware to spy on government Exchange servers
ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.
78
Turla Cereal malware copies government email from Exchange servers
ESET found the .NET toolset in Kazakhstan on November 28, 2025, and in Romania on December 23, 2025.
74
Turla’s Cereal toolset stole Kazakh and Romanian government email
ESET found no external command servers; Romania’s copy was set to collect mail involving the EU and NATO.
74
Appears with
- Turlathreat actor · 9
- Microsoftvendor · 9
- ESETorganization · 9
- Microsoft Exchangeproduct · 8
- CerealNeuronmalware · 6
- CerealBoxmalware · 6
- CerealHermitmalware · 4
- CerealRunnermalware · 3
- NATOorganization · 3
- European Unionorganization · 3
- FSBorganization · 3
- Romania national governmentvictim · 1
- CerealLoadermalware · 1
- Romanian government organizationvictim · 1
- CISAorganization · 1
- Romanian governmental organizationvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.