Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
Turla group uses new Cereal malware to spy on emails from compromised Exchange servers.
Russia-aligned threat actor Turla has deployed a new modular .NET malware toolkit, dubbed Cereal, to compromise Microsoft Exchange servers in Kazakhstan and Romania. The malware intercepts and copies emails directly from the mail flow, targeting messages with specific keywords or attachments related to NATO and EU addresses. Cereal operates by injecting itself into the Exchange transport process, avoiding detection by traditional transport agent monitoring.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRussia-aligned Turla embedded its Cereal malware directly into Microsoft Exchange's transport pipeline, allowing it to silently intercept and copy emails containing NATO and EU-related keywords without triggering conventional security alerts. The root failure lies in inadequate monitoring of Exchange transport agents and process injection activity — legitimate extension points that were abused to blend into normal server operations. This matters because mail servers are high-value espionage targets holding sensitive diplomatic and governmental communications, and attackers who operate inside trusted processes can persist undetected for extended periods. The campaign underscores that configuration hardening of mail infrastructure is as critical as perimeter defense.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Cereal
- malware — CerealNeuron
- malware — CerealHermit
- malware — CerealBox
- mitre_attack — T1071.001
- mitre_attack — T1041
- mitre_attack — T1105
- mitre_attack — T1003