Turla APT Deploys Modular Cereal Malware Framework to Harvest Emails from Microsoft Exchange Servers

The Russia-aligned threat actor Turla has been observed deploying a previously undocumented modular toolset called Cereal against government Exchange servers in Kazakhstan and Romania. The framework enables long-term stealthy email collection by abusing compromised Microsoft Exchange instances as internal C2 hubs without any external infrastructure. ESET researchers detailed how Cereal components run in memory, inject into EdgeTransport.exe, and filter messages containing DOC, DOCX or PDF attachments based on hardcoded sender, recipient, subject and attachment rules. In the Romanian incident the malware was configured to target NATO and European Union-related addresses. Commands are delivered as compiled .NET assemblies that CerealRunner executes in memory, supporting Active Directory enumeration, WMI queries, LSA Secrets extraction and file operations. The absence of disk artifacts and the use of serialization throughout the eight-component framework highlight Turla’s deep knowledge of Exchange internals.

The Hacker NewsNovember 10, 2026Translated from English

Read at source

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that is used to break into victims’ Microsoft Exchange servers with the aim of surreptitiously collecting emails.

According to an ESET report, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.

"The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," the Slovakian cybersecurity company said. "It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes."

The toolset is a collection of interconnected components capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest. Cereal gets its name from the extensive use of serialization.

Key technical characteristics

Absence of an external command-and-control infrastructure, instead abusing a compromised Exchange server for this purpose.
Sending commands in the form of separate, compiled .NET programs.
Using an automated email collection module injected into legitimate Microsoft Exchange processes.

The Cereal framework consists of eight moving parts: CerealRunner, CerealLoader, CerealSprinter, CerealIron, CerealMoth, CerealNeuron, CerealHermit and CerealBox. CerealBox injects itself into the Exchange transport service (EdgeTransport.exe) to process, filter and collect email messages.

Emails meeting the filtering criteria are compressed, encrypted and staged on disk before exfiltration via CerealNeuron commands. In the Romanian case, CerealBox was configured to gather messages involving NATO and European Union institutional addresses.

"The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands," said ESET researcher Matías Porolli.

ESET Microsoft Exchange Turla NATO Cereal Matías Porolli

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in APT & Nation-State

APT & Nation-State

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.

BleepingComputerNov 10, 2026Translated from English

APT & Nation-State

France Attributes October Refrigeration Sabotage Campaign to Iran's Shahid Kaveh IRGC Unit

French authorities have formally attributed a large-scale October cyber sabotage operation targeting refrigeration controllers at roughly 700 retail locations to the Shahid Kaveh cyber unit of Iran's Islamic Revolutionary Guard Corps. Attackers remotely accessed Danfoss and Dixell controllers on 11 October, altered defrost settings to maximum temperatures, disabled safety alerts, and triggered food spoilage plus at least 20 fires. The same infrastructure and techniques were used for reconnaissance against Schneider Electric equipment at small hydroelectric sites. France's C4 coordination center cited infrastructure reuse, FOFA scanning tool usage, Persian-language traces, and early propaganda claims by linked accounts as key attribution indicators. Judicial authorities have opened an investigation, requested international arrest warrants, and plan to seek EU sanctions against involved Iranian entities. CERT-FR issued detailed remediation guidance for both compromised and uncompromised Danfoss, Dixell, and Copeland devices emphasizing removal of internet exposure and secure VPN access only.

The Hacker NewsNov 10, 2026Translated from English

APT & Nation-State

France Attributes Large-Scale Cyber Sabotage of Supermarket Refrigeration Systems to Iranian Revolutionary Guard

France has formally blamed Iran’s Islamic Revolutionary Guard Corps for a major cyberattack that disrupted refrigeration systems in hundreds of supermarkets across the country. Prosecutors identified the Shahid Kaveh group as the perpetrator and opened a judicial investigation into organized cybercrime committed in the interests of a foreign power. The October 12 incident caused temperatures in affected stores to reach 50°C for six hours, resulting in massive food spoilage and tens of millions of euros in losses for chains such as Intermarché. French authorities summoned the Iranian ambassador, announced plans for European sanctions, and requested international arrest warrants for the group’s leaders. ANSSI also linked the Shahid Shoostari group, another IRGC-affiliated unit, to earlier attacks on Charlie Hebdo and the Paris 2024 Olympic Games organizing committee. Similar refrigeration-related incidents were reported in several other European countries during the same period.

SecurityWeekNov 10, 2026Translated from English