Skip to content
securitytabs

Updated · 1 update

ESET: Russia-aligned Turla uses new Cereal malware to spy on Exchange email

Security firm ESET says a Russia-aligned hacking group called Turla planted new spying software on the Microsoft Exchange email servers of two government organizations. No patch is involved; organizations running Exchange should read ESET's findings.

Turla Cereal malware found on Exchange email servers
Turla Cereal malware found on Exchange email servers

What's new

  1. Added when ESET first found the toolset and the NATO and EU email angle reported by Infosecurity Magazine. [1][2]

Newest coverage

TimelineWhat should my organization do?

What happened

ESET Research describes a toolset it calls Cereal, used by the Russia-aligned group Turla. ESET says it includes a novel module that collects email from Microsoft Exchange servers, a unique command-and-control mechanism, and sophisticated .NET execution tricks. [3][4]

ESET found the modular .NET toolset on Exchange servers at two government organizations, one in Kazakhstan and one in Romania, where it was used to copy selected email from the mail flow. The first detection was on 28 November 2025 at the Kazakhstan government body. [5][1]

Infosecurity Magazine reports that the compromised servers were used to collect emails linked to NATO and the EU. [2]

How the malware communicates

ESET says the toolset does not need an attacker-owned server. Operators send commands to the victim's internet-facing Exchange server, disguised as ordinary Outlook Web Access, Autodiscover and ActiveSync traffic. The tools lack many obvious indicators of compromise, which makes the traffic harder to distinguish from normal use. [5][6]

What is not yet known

The coverage reviewed does not say how the servers were first compromised, how many organizations are affected beyond the two described, or what mitigations ESET recommends. [3][5][4]

Timeline

  1. ESET's findings placed the toolset on Exchange servers at two government organizations in Kazakhstan and Romania. [5]

  2. ESET Research published its description of Turla's Cereal toolset. [3]

  3. ESET found the Cereal toolset at a government body in Kazakhstan. [1]

Update history

  1. Added when ESET first found the toolset and the NATO and EU email angle reported by Infosecurity Magazine. [1][2]

  2. First published

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small organizations rarely run their own Exchange servers, but if yours is hosted or managed by a provider, it could be a target of this kind of activity. No mitigation has been published in the coverage reviewed. [5]

What to do

  1. Ask your IT provider whether you use Microsoft Exchange servers exposed to the internet. [5]
  2. Ask the provider whether they have reviewed ESET's research on Cereal. [3]

Mid-size company

A small IT or security team

What to know

The reported victims were government organizations, and the malware hides its commands in normal-looking Exchange web traffic. ESET's research is the primary source for details. [3][5]

What to do

  1. Confirm which Exchange servers face the internet in your asset inventory. [5]
  2. Read ESET's research and check its published details against your Exchange servers. [3]

Large enterprise

A security operations team

What to know

ESET says the toolset has a novel Exchange email collection module and a command channel that avoids attacker infrastructure, so detection based on outbound connections may not catch it. [3][5]

What to do

  1. Hunt on internet-facing Exchange servers using the indicators and detections in ESET's research. [3]
  2. Review unusual requests to Outlook Web Access, Autodiscover and ActiveSync endpoints. [5]

Sources

  1. [1]Security Affairs · Nov 10, 20:40 UTC
    Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Roomcontext
  2. [2]Infosecurity Magazine · Nov 10, 14:30 UTC
    Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emailscontext
  3. [3]ESET WeLiveSecurity · Nov 10, 09:57 UTC
    Exchange for breakfast: Turla’s Cereal tricks are not for kidscontext
  4. [4]BleepingComputer · Nov 10, 10:04 UTC
    Turla hackers use new Cereal malware to spy on govt Exchange serverscontext
  5. [5]Help Net Security · Nov 10, 10:00 UTC
    Turla’s Cereal malware turns victims’ Exchange servers into spy hubscontext
  6. [6]CyberScoop · Nov 10, 10:00 UTC
    Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governmentscontext