The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]

Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report.

TL;DR Security researchers discovered a modular .NET toolset called Turla Cereal malware targeting government Microsoft Exchange servers. The attackers compromised state agencies in Kazakhstan and Romania without setting up external command servers. Instead, this Turla Cereal malware Exchange intrusion turns the victim's own email server into an operational base to intercept diplomatic communications. What Happened in the Intrusions In late 2025, security researchers detected a new set of cyber espionage tools running inside a government network in Kazakhstan.

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Turla Exchange malware Cereal hid on Kazakh and Romanian government mail servers, using the victims’ own Exchange servers as command posts.

Turla used compromised Exchange servers to collect NATO and EU-linked emails

Russia-aligned hacking group Turla is using a newly documented malware toolset called Cereal to turn compromised Microsoft Exchange servers into email collection systems and command centers.

Russian-linked espionage group Turla has deployed a previously undocumented .NET malware toolkit that turns compromised Microsoft Exchange servers.

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

A state-sponsored hacking collective has deployed an advanced modular toolset named Cereal to harvest emails from government Exchange servers.

ESET says Turla used its Cereal toolset on Microsoft Exchange servers at government agencies in Kazakhstan and Romania, including to collect NATO and EU emails.

ESET says Russia-aligned group Turla used a stealthy toolset, Cereal, on government Exchange servers in Kazakhstan and Romania to copy selected emails, including NATO and EU messages.

Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report.

要約 セキュリティ研究者は、政府機関のMicrosoft Exchangeサーバーを狙うモジュール型の.NETツールセット「Turla Cereal」マルウェアを発見しました。攻撃者はカザフスタンとルーマニアの政府機関を侵害しましたが、外部のコマンドサーバーは一切設置していません。この「Turla

ESET Research has uncovered a sophisticated, modular, tightly interconnected toolset, designed to run on Exchange servers of compromised entities for long-term cyberespionage.The Russia-aligned Turla APT group is behind the toolset; Turla is assessed to be part of Russia’s FSB.ESET observed the nove

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.