Turla uses Cereal malware to steal email from government Exchange servers
Original title: Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
ESET says the modular .NET toolset hit two government entities in Kazakhstan and Romania in late 2025, with no external C2.
ESET says the Russia-aligned group Turla, also known as Snake, used a previously undocumented toolset called Cereal against two governmental entities in Kazakhstan and Romania in late 2025. Cereal runs on Microsoft Exchange, executes commands in memory, and injects an email harvester into EdgeTransport.exe. It filters for DOC, DOCX, or PDF messages, then stages, encrypts, and exfiltrates matches. Initial access is unknown.
Unconfirmed: The initial access vector for these intrusions is unknown.
- Cereal has eight components, including CerealNeuron, CerealHermit, and CerealBox.
- CerealBox injects into EdgeTransport.exe and filters by sender, recipient, subject, or attachment name.
- The Romanian case was configured for NATO and EU institutional addresses, ESET said.
- Commands can query Active Directory, run WMI, extract LSA Secrets, and list volume snapshots.
- ESET shared the report with The Hacker News ahead of publication.
Impact: Stealthy collection of filtered emails from Exchange servers
- ATT&CK
- T1055 Process InjectionT1114.002 Remote Email CollectionT1047 Windows Management InstrumentationT1003.004 LSA Secrets
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Malware
- Cereal
- Organizations
- ESET
- Countries
- KazakhstanRomaniaRussia
From the original article
3 min read at thehackernews.com
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.