Security News · cyberscoop.com

ESET Details Turla’s Modular Toolset for Compromising Government Exchange Servers

Nov 10, 2026 · Original article ↗

Summary

ESET says Turla’s Cereal toolset was found on government Exchange servers in Kazakhstan and Romania. It uses compromised servers for command handling and collection, with stealth techniques that avoid common malware indicators.

Key points

ESET discovered the modular toolset, named Turla’s Cereal, on a Kazakhstan government Exchange server in November 2025 and later found a version at a Romanian government agency.
The toolset chains legitimate functions across Microsoft Exchange, Windows, and .NET assemblies.
A compromised Exchange server can act as command-and-control infrastructure, rather than the malware relying on external C2 infrastructure.
The CerealNeuron backdoor passively listens for incoming web requests on paths resembling ordinary Exchange traffic.
ESET says most executables run in memory using temporary storage; commands written to permanent memory are delivered through encrypted payloads.
The Romanian version was configured to target emails sent to or received from the EU and NATO, according to ESET.

Article Details

Event Type: Cyberespionage campaign using a new modular toolset to compromise government Exchange servers.
Impact: The toolset was found on compromised government Exchange servers in Kazakhstan and Romania. It could receive commands, execute in memory, gather organizational intelligence, and collect email messages. The Romanian version was configured to target messages sent to or received from the European Union and NATO.

MITRE ATT&CK

T1071.001 · Web ProtocolsCerealNeuron passively listens for incoming web requests on paths resembling ordinary Exchange traffic, and the compromised server acts as command-and-control infrastructure.T1114.002 · Remote Email CollectionThe toolset collected email messages from compromised Exchange servers.

People

Matías PorolliESET researcher who wrote the report describing Turla’s Cereal and its use against compromised Exchange servers.

Threat Actors

TurlaA cyberespionage group that the article says is aligned with the Russian government; Western governments and threat intelligence firms have attributed the group to Russia’s FSB. The article reports its use of the toolset against government Exchange servers.

Malware

CerealNeuronOne component, dubbed CerealNeuron, operates as the main backdoor but does not beacon back to its operator the way many pieces of malware do.

Products

.NETIt chains and exploits different legitimate functions across Microsoft Exchange, Windows, and .NET assemblies, which Microsoft has described as “the fundamental units of deployment, version control, reuse, activation Microsoft ExchangeIt chains and exploits different legitimate functions across Microsoft Exchange, Windows, and .NET assemblies, which Microsoft has described as “the fundamental units of deployment, version control, reuse, activation Microsoft WindowsIt chains and exploits different legitimate functions across Microsoft Exchange, Windows, and .NET assemblies, which Microsoft has described as “the fundamental units of deployment, version control, reuse, activation

Tools

Turla’s CerealThe toolset was first discovered in November 2025 by cybersecurity firm ESET, which named it “Turla’s Cereal” as a play on its highly modular, interconnected and “serialized” design.

Countries

KazakhstanTurla, a notorious cyberespionage group aligned with the Russian government, has been wielding a new, customizable toolset to compromise governments around the world over the past year, including Kazakhstan.RussiaMultiple Western governments and threat intelligence firms have attributed Turla as a part of Russia’s Federal Security Service (FSB), which is tasked with gathering intelligence on foreign governments, businesses and

Industries

GovernmentTurla, a notorious cyberespionage group aligned with the Russian government, has been wielding a new, customizable toolset to compromise governments around the world over the past year, including Kazakhstan.

Related Articles