Turla uses Cereal malware to collect email from Exchange servers
Original title: Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft
ESET found the toolset at government organizations in Kazakhstan and Romania, with activity dating to late 2025.
ESET Research said on November 10, 2026, that Turla deployed a malware toolset called Cereal on compromised Microsoft Exchange servers. It copies selected messages while delivery continues and can execute tasks through the server itself. The identified targets were government organizations in Kazakhstan and Romania. Initial access was not determined, and no specific Exchange vulnerability was confirmed.
Unconfirmed: ESET could not determine initial access and did not establish exploitation of a particular Exchange vulnerability.
- First detection was a Kazakh government organization on November 28, 2025.
- Romanian activity dated to December 23, 2025, with NATO and EU address filters.
- CerealNeuron waits on Exchange-like URL paths rather than calling a command server.
- CerealBox hooks existing transport-agent handlers inside EdgeTransport.exe.
- Operators used DLL search-order hijacking and the .NET native image cache.
Impact: selected emails copied and commands run on Exchange
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Look for Cereal loaders in the .NET native image cache and DLL search-order hijacks.
- ATT&CK
- T1574.001 DLL Search Order HijackingT1114.002 Remote Email CollectionT1552.001 Credentials In FilesT1057 Process DiscoveryT1087.002 Account Discovery: Domain Account
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Organizations
- ESET
- Countries
- KazakhstanRomania
From the original article
3 min read at cybersecuritynews.com
Russia-aligned hacking group Turla is using a newly documented malware toolset called Cereal to turn compromised Microsoft Exchange servers into email collection systems and command centers. ESET Research disclosed the findings on November 10, 2026, describing attacks against government organizations in Kazakhstan and Romania. The malware copies selected emails while allowing normal delivery to continue, […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.