Threat Actors Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and destroy_v6 Wiper on ESXi Hosts

Turla APT Deploys Modular Cereal Malware Framework to Harvest Emails from Microsoft Exchange Servers

The Russia-aligned threat actor Turla has been observed deploying a previously undocumented modular toolset called Cereal against government Exchange servers in Kazakhstan and Romania. The framework enables long-term stealthy email collection by abusing compromised Microsoft Exchange instances as internal C2 hubs without any external infrastructure. ESET researchers detailed how Cereal components run in memory, inject into EdgeTransport.exe, and filter messages containing DOC, DOCX or PDF attachments based on hardcoded sender, recipient, subject and attachment rules. In the Romanian incident the malware was configured to target NATO and European Union-related addresses. Commands are delivered as compiled .NET assemblies that CerealRunner executes in memory, supporting Active Directory enumeration, WMI queries, LSA Secrets extraction and file operations. The absence of disk artifacts and the use of serialization throughout the eight-component framework highlight Turla’s deep knowledge of Exchange internals.

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.

France Attributes October Refrigeration Sabotage Campaign to Iran's Shahid Kaveh IRGC Unit

French authorities have formally attributed a large-scale October cyber sabotage operation targeting refrigeration controllers at roughly 700 retail locations to the Shahid Kaveh cyber unit of Iran's Islamic Revolutionary Guard Corps. Attackers remotely accessed Danfoss and Dixell controllers on 11 October, altered defrost settings to maximum temperatures, disabled safety alerts, and triggered food spoilage plus at least 20 fires. The same infrastructure and techniques were used for reconnaissance against Schneider Electric equipment at small hydroelectric sites. France's C4 coordination center cited infrastructure reuse, FOFA scanning tool usage, Persian-language traces, and early propaganda claims by linked accounts as key attribution indicators. Judicial authorities have opened an investigation, requested international arrest warrants, and plan to seek EU sanctions against involved Iranian entities. CERT-FR issued detailed remediation guidance for both compromised and uncompromised Danfoss, Dixell, and Copeland devices emphasizing removal of internet exposure and secure VPN access only.