Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft

Cybersecuritynews •Guru Baran • November 10, 2026

Russia-aligned hacking group Turla is using a newly documented malware toolset called Cereal to turn compromised Microsoft Exchange servers into email collection systems and command centers. ESET Research disclosed the findings on November 10, 2026, describing attacks against government organizations in Kazakhstan and Romania. The malware copies selected emails while allowing normal delivery to continue, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Turla Group Uses Cereal Malware to Spy on Government Email Servers The Russian state-aligned group Turla has deployed a new malware toolkit named Cereal to compromise Microsoft Exchange servers at government organizations in Kazakhstan and Romania. This sophisticated toolset, discovered by ESET, allows attackers to intercept and collect emails, particularly those involving NATO and EU communications. The malware operates without external command-and-control infrastructure, instead using the compromised servers to execute commands and gather intelligence. ESET first identified Cereal in a Kazakh government agency on November 28, 2025, and later in Romania on December 23, 2025. The Cereal toolkit is modular, utilizing components like CerealBox and CerealNeuron to hijack email transport processes and selectively capture messages based on predefined criteria. The attacks reflect ongoing geopolitical tensions, particularly in the context of Russia's actions in Ukraine and its relations with NATO. ESET attributes the toolset to Turla with high confidence due to its technical similarities to previously documented malware associated with the group. 10 sources 78

Extracted Entities

Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (2)

Industries (1)

Malware (1)

Platforms (1)