{"id":4058,"date":"2026-11-10T14:14:54","date_gmt":"2026-11-10T14:14:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4058"},"modified":"2026-11-10T14:14:54","modified_gmt":"2026-11-10T14:14:54","slug":"russian-turla-hackers-use-new-cereal-malware-to-steal-emails-from-government-exchange-servers","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4058","title":{"rendered":"Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 10, 2026<\/span><\/span>Cyber Espionage \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal<\/strong> that’s used to break into victims’ Microsoft Exchange servers with an aim to surreptitiously collect emails.<\/p>\n

According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.<\/p>\n

\u00abThe Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage,\u00bb the Slovakian cybersecurity company said<\/a>. \u00abIt leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.\u00bb<\/p>\n

\u00abThe Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers \u2013 they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.\u00bb<\/p>\n

The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest. The initial access vector used to deliver the malware is unknown, although the group is known to conduct<\/a> spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Cereal gets its name from the fact that the tools make extensive use of serialization<\/a>, which refers to the process of converting a data structure or an object’s state into a format that can be easily stored, transmitted, and reconstructed.<\/p>\n

<\/p>\n

A number of aspects make the malware stand apart –<\/p>\n