# Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers

Source: [The Hacker News](https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html) · 2026-11-10 · Security
Page: https://themorning.dev/story/russian-turla-hackers-use-new-cereal-malware-to-steal-emails-from-government-exc-7d35c70e67083122
Kind: security · Impact: high

## In brief

- Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
- The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
- ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

## Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

## Timeline

- 2026-11-10: ESET findings on the Cereal malware used by Turla reported

## Coverage

- [Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers](https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html) — The Hacker News, 2026-11-10
- [Turla hackers use new Cereal malware to spy on govt Exchange servers](https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/) — BleepingComputer, 2026-11-10
- [Turla’s Cereal malware turns victims’ Exchange servers into spy hubs](https://www.helpnetsecurity.com/2026/11/10/eset-turla-exchange-malware/) — Help Net Security, 2026-11-10
- [Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments](https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhstan-romanian-governments/) — CyberScoop, 2026-11-10

Tags: espionage, turla, microsoft-exchange, malware, email-security, government

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev