CerealHermit

Search everything

Mentions · 7d4
Mentions · 30d4
All mentions4
First seenNov 10, 2026
Last mentioned5h ago

Timeline

4 articles · newest first

Turla’s Cereal toolset found on government Exchange servers

ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.

Security AffairsNov 10, 20:40 UTC · 5h agoThreat actor 9 sources

Turla uses Cereal malware to collect email from Exchange servers

ESET found the toolset at government organizations in Kazakhstan and Romania, with activity dating to late 2025.

Cyber Security Newsupdated Nov 10, 20:40 UTC · 5h agofirst Nov 10, 13:42 UTC · 12h agoThreat actor 9 sources

Turla uses Cereal malware to spy on government Exchange servers

ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.

BleepingComputerupdated Nov 10, 20:40 UTC · 5h agofirst Nov 10, 10:04 UTC · 15h agoThreat actor 9 sources1

Turla Cereal malware copies government email from Exchange servers

ESET found the .NET toolset in Kazakhstan on November 28, 2025, and in Romania on December 23, 2025.

Help Net Securityupdated Nov 10, 20:40 UTC · 5h agofirst Nov 10, 10:00 UTC · 15h agoMalware 9 sources1

Appears with

CerealNeuronmalware · 4
Turlathreat actor · 4
CerealBoxmalware · 4
ESETorganization · 4
Cerealmalware · 4
Microsoftvendor · 4
CerealRunnermalware · 3
Microsoft Exchangeproduct · 3
Romanian government organizationvictim · 1
FSBorganization · 1
CISAorganization · 1
NATOorganization · 1
European Unionorganization · 1
Exchangeproduct · 1
Kazakh government organizationvictim · 1
CerealLoadermalware · 1

Entities are extracted by the model from each article. First seen Nov 10, 2026, last mentioned 5h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.