Russian state-linked hacking group Turla is using a previously undocumented malware toolset, dubbed “Cereal,” to compromise Microsoft Exchange servers used by government organisations and surreptitiously collect emails. The reporting is based on findings from an ESET report shared with multiple outlets.
Across coverage, “Cereal” is described as modular and designed to intercept or copy selected messages directly through the Exchange environment. Several outlets say the malware operators communicate with victim systems by sending commands that resemble normal Exchange-related traffic, including Outlook Web Access, Autodiscover, and ActiveSync.
Where details are provided, outlets also describe victim impact in terms of Exchange servers being turned into “spy hubs,” with Turla targeting organisations in Kazakhstan and Romania. The approaches to emphasising technical discovery versus broader espionage framing vary by publication, but the core account—Turla’s new toolset for email theft from government Exchange servers—remains consistent.
