[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUun-7NytD9xschwcAUQlhopdhJosdr0N-bw7l8gYUc0":3},{"article":4,"iocs":52,"watch_terms":59,"solutions":60,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"1d077138-52a0-4159-893c-559715e056e7","Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft","turla-hackers-use-cereal-malware-toolset-to-exploit-microsoft-exchange-servers-f-cc7cb0","Russia-aligned hacking group Turla is using a newly documented malware toolset called Cereal to turn compromised Microsoft Exchange servers into email collection systems and command centers. ESET Research disclosed the findings on November 10, 2026, describing attacks against government organizations in Kazakhstan and Romania. The malware copies selected emails while allowing normal delivery to continue, […] The post Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft appeared first on Cyber Security News.","The Russia-aligned Turla hacking group is utilizing a new malware toolset named Cereal to compromise Microsoft Exchange servers, transforming them into email collection systems. ESET Research discovered these attacks targeting government organizations in Kazakhstan and Romania, noting that the malware copies emails while allowing normal delivery, thus avoiding detection. The attackers specifically filtered messages involving NATO and EU addresses, indicating a focus on intelligence gathering.","Turla hackers use Cereal malware to steal emails from Microsoft Exchange servers.","https:\u002F\u002Fcybersecuritynews.com\u002Fturla-hackers-attacking-exchange-servers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FTurla-Hackers-Attacking-Exchange-servers.webp","2026-11-10T13:42:57+00:00","2026-11-10T14:00:28.466518+00:00",8,[17,20,23,26],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":22},"Microsoft Exchange Servers","product",{"name":24,"type":25},"ESET","vendor",{"name":27,"type":28},"STOCKSTAY","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":29,"icon":31,"name":32,"slug":33},[53,57],{"type":54,"value":55,"context":56},"domain","nato.int","Filtered email recipient domain",{"type":54,"value":58,"context":56},"europa.eu",[24,21],{"controls":61,"vendors":145},[62,91,116],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":33,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":104,"product_name":105,"url":106,"description":107},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":117,"name":118,"problem":119,"products":120},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[146,151],{"slug":147,"name":24,"logo_path":148,"roles":149},"eset","\u002Fvendor-logos\u002Feset.png",[150],"reported_by",{"slug":122,"name":123,"logo_path":124,"roles":152},[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":164},"turlas-cereal-malware-silently-harvests-emails-from-exchange-servers","Turla's Cereal Malware Silently Harvests Emails from Exchange Servers","The Turla group exploited Microsoft Exchange servers to deploy the Cereal malware toolset, which covertly copied emails while still delivering them normally to recipients — a design specifically intended to evade detection. Government organizations in Kazakhstan and Romania were targeted, with attackers filtering for NATO and EU-related communications, revealing a clear intelligence-collection motive. This incident highlights how undetected server-level compromise can expose sensitive diplomatic communications for extended periods. The ability to passively intercept email without disrupting delivery makes this threat particularly dangerous because standard user-facing monitoring will show no anomalies.",[159,160,161,162,163],"MITRE ATT&CK T1114.002: Email Collection: Remote Email Collection","CIS Control 10: Malware Defenses (v8)","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":165,"CIS Control 10: Malware Defenses (v8)":166,"MITRE ATT&CK T1114.002: Email Collection: Remote Email Collection":167,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":168,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":169},"Proper access control and asset management over Exchange server administrative interfaces would have limited Turla's ability to install and operate the Cereal malware toolset undetected.","Deploying malware detection and behavioral monitoring on Exchange servers would have flagged the unauthorized transport agents or processes introduced by the Cereal toolset.","Turla's Cereal toolset specifically collected emails at the server transport layer, which is precisely the server-side remote email collection technique this sub-technique describes.","Integrity verification of Exchange server components would have detected the unauthorized modifications made by Turla to intercept mail flow.","Continuous monitoring of Exchange server network behavior and internal processes would have surfaced the covert email copying activity before significant data was exfiltrated."]