Exchange for breakfast: Turla’s Cereal tricks are not for kids
Turla APT group deploys Cereal toolset on Exchange servers for espionage.
ESET Research has identified a new toolset, dubbed 'Cereal', deployed by the Russia-aligned APT group Turla on Microsoft Exchange servers. This modular .NET malware is designed for long-term cyberespionage, capable of executing commands in memory, mapping compromised organizations, and collecting specific emails. Notably, Cereal utilizes the victim's Exchange server as its command and control infrastructure, avoiding external C2 servers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Exchange?
Get an email when a new story names Microsoft Exchange, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Cereal
- malware — Snake