[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLSh5_vK2epwZz0cwO0w3JeL7ZKIXfW7yx9znso0ta28":3},{"article":4,"iocs":53,"watch_terms":66,"solutions":67,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"ec4ed060-bbd3-447f-bde9-d1dfd7f49242","Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room","russia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room-1514e6","ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a […]","ESET Research has detailed a new, undocumented toolset called Cereal, used by the Russia-linked APT group Turla on government Microsoft Exchange servers in Kazakhstan and Romania. The toolset, which arrives encrypted and unpacks in memory with minimal file presence, uses the victim's Exchange server as a control point, making detection difficult. ESET attributes the activity with high confidence to Turla, a group active since at least 2004.","Russia-linked APT Turla uses new Cereal toolset on government Exchange servers in Kazakhstan and Romania.","https:\u002F\u002Fsecurityaffairs.com\u002F202800\u002Fapt\u002Frussia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-19.png","2026-11-10T20:40:48+00:00","2026-11-10T22:00:30.857693+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":19},"Secret Blizzard",{"name":23,"type":19},"Snake",{"name":25,"type":19},"Uroburos",{"name":27,"type":19},"Waterbug",{"name":29,"type":19},"Venomous Bear","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60,63],{"type":47,"value":55,"context":56},"Cereal","Undocumented toolset used by APT Turla",{"type":47,"value":58,"context":59},"CerealNeuron","Main backdoor component of the Cereal toolset",{"type":47,"value":61,"context":62},"CerealHermit","Second version of the Cereal toolset with no network functions",{"type":47,"value":64,"context":65},"CerealRunner","Component that receives and executes malicious .NET programs",[],{"controls":68,"vendors":153},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":99,"name":100,"problem":101,"products":102},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":128,"name":129,"problem":130,"products":131},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[132,137,145],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[154,157],{"slug":83,"name":84,"logo_path":85,"roles":155},[156],"reported_by",{"slug":158,"name":159,"logo_path":160,"roles":161},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[162],"affected",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":173},"turla-hijacked-exchange-servers-as-covert-c2-infrastructure","Turla Hijacked Exchange Servers as Covert C2 Infrastructure","The Russia-linked APT group Turla repurposed victim Microsoft Exchange servers in government networks as command-and-control points, using an encrypted, memory-resident toolset called Cereal that left minimal forensic traces on disk. This technique exploits trusted internal infrastructure, making traffic appear legitimate and evading perimeter-based detection. The attack highlights how critical servers like Exchange—which handle vast volumes of sensitive communications—can be silently weaponised when endpoint visibility, behavioural monitoring, and hardening controls are insufficient. The long operational dwell time typical of Turla campaigns underscores that without robust anomaly detection on high-value servers, adversaries can maintain persistent access undetected for extended periods.",[168,169,170,171,172],"CIS Control 10: Malware Defenses (v8)","CIS Control 13: Network Monitoring and Defense (v8)","NIST SP 800-53 SI-4: System Monitoring","MITRE ATT&CK T1505.003: Server Software Component: Web Shell","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":174,"CIS Control 10: Malware Defenses (v8)":175,"NIST SP 800-53 SI-4: System Monitoring":176,"CIS Control 13: Network Monitoring and Defense (v8)":177,"MITRE ATT&CK T1505.003: Server Software Component: Web Shell":178},"NIS2 Article 21(2)(i) requires access control and asset management measures that would have restricted which processes and accounts could interact with Exchange server internals, limiting Turla's ability to install and operate Cereal.","CIS Control 10 requires anti-malware tooling capable of detecting in-memory threats; Cereal's encrypted, memory-resident design was specifically built to evade solutions that only inspect files on disk.","SI-4 requires continuous monitoring of information systems for signs of attack; Turla's long dwell time on Exchange servers reflects an absence of the behavioural monitoring this control mandates.","CIS Control 13 requires monitoring of network traffic for anomalous behaviour; detecting an Exchange server acting as a C2 relay depends on visibility into unexpected outbound and lateral connections.","Turla's use of Exchange server-side implants to receive and relay attacker commands mirrors the web shell sub-technique, where adversaries abuse server software to maintain persistent C2 access."]