Turla Cereal malware turns Exchange servers into spy hubs

# Turla Cereal malware turns Exchange servers into spy hubs

https://gcdradar.vercel.app/incidents/turla-cereal-malware-turns-exchange-servers-into-spy-hubs · AIR-2026-1851 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world espionage campaign against named targets.
- Fix status: No fix needed
- First reported: 2026-11-10
- AI role: No AI role
- Products: Microsoft Exchange

## Summary

The Russia-aligned threat group Turla deployed a modular .NET toolset named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. The malware hijacks mail flow traffic to stealthily exfiltrate emails without requiring an external command-and-control server.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-10: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments (https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhstan-romanian-governments)
- 2026-11-10: Turla hackers use new Cereal malware to spy on govt Exchange servers (https://bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers)
- 2026-11-10: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs (https://helpnetsecurity.com/2026/11/10/eset-turla-exchange-malware)

## Sources

- 2026-11-10 Help Net Security: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs https://helpnetsecurity.com/2026/11/10/eset-turla-exchange-malware
- 2026-11-10 BleepingComputer: Turla hackers use new Cereal malware to spy on govt Exchange servers https://bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers
- 2026-11-10 CyberScoop: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhstan-romanian-governments

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.