Skip to content

Threat Actors

Turla’s Cereal toolset exfiltrates government Exchange emails

ESET discovered the modular .NET framework on servers in Kazakhstan and Romania, with no external command-and-control infrastructure.

By · 1 min read

https://breach-signal.com/threat-actors/turla-cereal-toolset-exfiltrates-government-exchange-emails/

Open grid notebook with a blue human eye across pages, symbolizing surveillance, held against a purple blurred background.
A detailed blue eye spans the gridded pages of an open notebook, evoking themes of surveillance and covert monitoring. Photo by janrye on Pixabay

Share

Key facts

  • ESET discovered a new modular .NET toolset named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania.
  • For the Romanian victim, the collection module focused on messages involving NATO and European Union institutional addresses.
  • The researchers found no external command-and-control infrastructure, so the compromised Exchange server itself acts as the only control point.
  • CerealBox injects into EdgeTransport.exe and works with existing transport agent handlers loaded in memory so mail continues and no new agent appears.

Tags: , ,

Was this helpful?

Join the discussion

Please read our Comment Policy before commenting. First-time comments are held for moderation. By posting a comment you agree to our Terms of Use and Privacy Policy, which explain how your name, email address and comment are used.

Your email address will not be published. Required fields are marked *

Most read

  1. Burnaby School District Confirms ransomware attack as Qilin claims data leak
  2. Forescout finds thousands of internet-exposed refrigeration controls worldwide
  3. Attackers exploit critical Node-RED flaw CVE-2026-58115 from single IP
  4. SANS ISC discloses a new ClickFix campaign targeting macOS and Windows users
  5. CERT-EU warns of critical PHP flaws CVE-2026-109618 and CVE-2026-109619