Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
Russian Turla group uses new stealthy toolset to steal emails from Kazakhstan and Romania.
The Russian government-aligned Turla group has been using a new, modular toolset dubbed 'Turla's Cereal' to conduct stealthy email espionage against government entities in Kazakhstan and Romania. This toolset exploits legitimate functions within Microsoft Exchange servers, co-opting them as command and control infrastructure, making detection extremely difficult due to a lack of traditional indicators of compromise.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Russian Turla group exploited legitimate Microsoft Exchange server functions to establish covert command-and-control infrastructure, enabling silent theft of government emails in Kazakhstan and Romania. By weaponising built-in Exchange capabilities rather than deploying obvious malware, the attackers deliberately avoided traditional indicators of compromise, making detection through standard tooling extremely difficult. This highlights the danger of treating legitimate system functions as inherently trustworthy, and underscores how advanced persistent threat (APT) actors increasingly 'live off the land' to evade defences. Without robust behavioural monitoring and strict configuration baselines on critical mail infrastructure, such intrusions can persist undetected for months or years.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Turla's Cereal
- malware — CerealNeuron