ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December.
Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room
About this summary. This is a short excerpt from the description that Security Affairs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securityaffairs.com/202800/apt/russia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room.html
Source attribution: headline and facts are from Security Affairs (securityaffairs.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
Turla, a notorious cyberespionage group aligned with the Russian government, has been wielding a new, customizable toolset to compromise governments around the world…
Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used…
In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach
Noteworthy stories that might have slipped under the radar: Siemens details security advisory policy, OpenAI Codex backdoor risk, Microsoft warns of model weight…
Microsoft Outage 2026: What Happened and What the Law Says
While many are still focused on Microsoft’s global outage and Microsoft is still working on recovery, there is already a legal perspective. Edmarverson A. Santos of…
Microsoft Outlook Outage: What You Need to Know
The Microsoft Outlook outage that started on November 12, 2026, began as an Exchange Online mailbox access problem in the Americas and widened into a global Microsoft…
Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams
Microsoft says failed server health checks disrupted Outlook and other Microsoft 365 services. The company is still investigating the cause and has disclosed no evidence…