International
The Morning Dev

Only the news worth knowing

‹
 
A67/100

Malware · high

Turla deploys Cereal malware against government Exchange servers

Tier A · Patch today – Before you go home

Who’s exposed: Government Exchange servers in Kazakhstan and Romania

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild · Secrets exposed

The Brief

  • Russia-aligned Turla (aka Snake) is using a previously undocumented modular .NET toolset called Cereal, according to ESET researchers.
  • The malware was planted on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania.
  • Cereal copies selected email directly from the mail flow, and sources say Turla has used the toolset against governments over the past year.

Why it matters

Exchange servers at government bodies are being used to silently copy email, including correspondence with NATO and EU officials, so administrators running on-premises Exchange should treat mail-flow monitoring as a priority.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: Microsoft Exchange is enterprise mail software that IT teams run and maintain.
NoCore infrastructureJudgment: a single vendor's mail product, not foundational software like OpenSSH or the Linux kernel.
YesPopular toolJudgment: Microsoft Exchange is a widely deployed mainstream enterprise platform used by many organizations.
YesExploited in the wildHelp Net Security and CyberScoop: Turla used the Cereal toolset to steal emails from government Exchange servers.
NoPublic exploitNo source says exploit code or a proof-of-concept was published.
NoRemote, no loginNo source describes the initial access method or whether it needs no credentials.
NoFull takeoverSources say malware was planted on servers but do not state code execution or admin/root rights.
YesSecrets exposedThe Record and Help Net Security: government email, including NATO and EU correspondence, was intercepted and copied.
NoSupply chainNo source reports a legitimate package, update, build pipeline or signing key being compromised.
NoNo fix yetNo source mentions patch status or a missing vendor fix.

Timeline

  1. ESET researchers publicly disclose the Cereal malware used by Turla against government Exchange servers

  2. CyberScoop

    Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

  3. Help Net Security

    Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

  4. BleepingComputer

    Turla hackers use new Cereal malware to spy on govt Exchange servers

  5. The Hacker News

    Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

  6. The Record from Recorded Future News

    Russian hackers compromised government email servers to steal NATO, EU correspondence

  7. darkreading

    AI Makes Reverse Engineering Mainstream Software & Malware Far Easier

  8. Security Affairs

    Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

Full coverage · 7 sources

First seen · 7 sources · Full story page · How tiers are decided