Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

The Russia-linked APT group Turla repurposed victim Microsoft Exchange servers in government networks as command-and-control points, using an encrypted, memory-resident toolset called Cereal that left minimal forensic traces on disk. This technique exploits trusted internal infrastructure, making traffic appear legitimate and evading perimeter-based detection. The attack highlights how critical servers like Exchange—which handle vast volumes of sensitive communications—can be silently weaponised when endpoint visibility, behavioural monitoring, and hardening controls are insufficient. The long operational dwell time typical of Turla campaigns underscores that without robust anomaly detection on high-value servers, adversaries can maintain persistent access undetected for extended periods.