Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft - CyberSecurityNews
Russia-aligned hacking group Turla is using a new malware toolset called Cereal to compromise Microsoft Exchange servers for email theft and espionage.
ESET Research disclosed the findings on November 10, 2026, describing attacks against government organizations in Kazakhstan and Romania. The malware copies selected emails while allowing normal delivery to continue, helping attackers collect sensitive information without causing obvious service failures.
Targeted Intelligence Collection
Researchers first detected the toolset at a Kazakh government organization on November 28, 2025. After improving detection rules, they identified another compromised government organization in Romania, where activity dated to December 23, 2025.
In Romania, the attackers configured the malware to identify messages involving NATO and European Union addresses, including nato.int and europa.eu. These filters point to targeted intelligence collection rather than broad, random email theft.
Cereal Architecture
Cereal takes its name from serialization, a process for packaging program data. Its components use this approach to carry encrypted .NET programs, unpack them, and run them in memory. CerealLoader is the only component stored as a recognizable, unencrypted .NET file.
Exchange as Command Center
CerealNeuron serves as a passive backdoor, waiting for incoming requests on the compromised Exchange server rather than contacting an outside command server. Observed paths include /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/, which resemble normal Exchange services.
Requests that pass encryption and integrity checks deliver programs for execution. Invalid requests receive redirects to an Exchange error page.
CerealRunner packages individual tasks as encrypted .NET programs, which have been observed retrieving mail through Exchange Web Services, querying Active Directory, and extracting locally stored credentials. A second backdoor, CerealHermit, reads encrypted commands from disk instead of the network.
Related
