Security · High impactFan score 69 · Tier A4 sources

Turla hackers use new Cereal malware to spy on govt Exchange servers

BleepingComputer · By Bill Toulas · 2h ago

The Brief · written from 4 sources

Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

Who’s affected

Government organizations running Microsoft Exchange servers
Teams operating on-premises Exchange email infrastructure

#espionage
#turla
#microsoft-exchange
#malware
#email-security
#government

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]

Read the full story at bleepingcomputer.com ↗