GoKawiilTurla's new Cereal malware targets Exchange servers at NATO-linked agencies
ESET researchers say the Russian state-backed hacking group Turla deployed a new .NET-based toolset called Cereal to intercept emails from Microsoft Exchange servers at government organizations, first spotted in Kazakhstan and later at a Romanian government agency compromised on December 23, 2025. The malware, including a component called CerealBox, injects into Exchange's mail-processing process to covertly read messages containing document attachments and correspondence tied to NATO and EU officials without disrupting normal mail flow.
GoKawiil's interpretation of the reporting above, not reported fact.
The technique of hijacking existing transport agent handlers rather than registering new ones suggests Turla is prioritizing stealth, making detection harder for defenders relying on traditional monitoring of Exchange add-ins. Because the malware specifically filters for NATO- and EU-related correspondence, the campaign could reflect an intelligence-gathering interest in Western diplomatic and military coordination, according to ESET's findings.
- Turla used a new toolset called Cereal to covertly intercept Exchange emails at government bodies.
- The malware was found in Kazakhstan and later at a Romanian agency compromised on December 23, 2025.
- It selectively targeted messages with document attachments linked to NATO and EU contacts.
Source: bleepingcomputer.com, 2026-11-10
Published there as: “Turla hackers use new Cereal malware to spy on govt Exchange servers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.