Turla uses Cereal malware to spy on government Exchange servers
Original title: Turla hackers use new Cereal malware to spy on govt Exchange servers
ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.
ESET says Russian state-linked Turla deployed a new toolset called Cereal against Microsoft Exchange servers at government organizations. CerealBox injects into EdgeTransport.exe and collects selected messages with document attachments without registering a new transport agent. CerealNeuron accepts encrypted web commands on the compromised server, which itself is the only control point; CerealHermit can read commands from disk instead. ESET published indicators of compromise.
Unconfirmed: ESET did not explain how CerealHermit command files are placed or how results are retrieved.
- The Romania system was compromised on December 23, 2025.
- Collection targeted .DOC, .DOCX, and .PDF attachments matching sender, recipient, or subject rules.
- Commands can query Active Directory, extract local credentials, and read or delete files.
- ESET found no external command-and-control infrastructure.
- CerealHermit lacks network access and may act as a fallback.
Impact: Selective collection of government email and local data
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Review the Cereal indicators of compromise published by ESET.
- ATT&CK
- T1055 Process InjectionT1114 Email CollectionT1087.002 Domain Account DiscoveryT1552 Unsecured Credentials
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Organizations
- ESET
- Countries
- KazakhstanRomaniaRussia
From the original article
3 min read at bleepingcomputer.com
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.