Turla Uses Cereal Toolset to Steal Emails from Government Exchange Servers
Summary
ESET reports that Turla used its Cereal toolset against government entities in Kazakhstan and Romania in late 2025. The modular malware runs on Exchange servers to collect selected emails and execute commands in memory; its initial access method is unknown.
Key points
- ESET says Cereal was observed against two government entities in Kazakhstan and Romania in late 2025.
- The modular toolset runs on Microsoft Exchange servers and can receive commands, map networks, and collect selected emails.
- It filters messages using sender, recipient, subject, and attachment-name lists, then compresses and encrypts selected emails before staging them for exfiltration and deletion.
- CerealRunner unpacks and executes compiled .NET commands in memory; CerealNeuron handles results for subsequent exfiltration.
- Supported commands include mailbox retrieval, Active Directory queries, WMI queries, LSA Secrets extraction, and file operations.
- The initial access method is unknown; the article notes Turla is known to use spear-phishing, watering-hole, and ISP-level adversary-in-the-middle attacks.
Article Details
- Attack Vectors
- Initial access is unknown. The article says Turla is known to use spear-phishing, watering-hole attacks, and ISP-level adversary-in-the-middle (AitM) attacks.
MITRE ATT&CK
T1003.004 · LSA SecretsCereal commands can extract LSA Secrets.T1018 · Remote System DiscoveryCereal can queue Active Directory computer and DNS-record information to map the infected network.T1041 · Exfiltration Over C2 ChannelCereal sends results back to CerealNeuron for subsequent encrypted exfiltration to Turla.T1069.002 · Domain GroupsCereal can queue group information from Active Directory.T1074.001 · Local Data StagingEmails selected for collection are staged in files on disk before exfiltration.T1087.002 · Domain AccountCereal can queue user information from Active Directory.T1114.002 · Remote Email CollectionCereal retrieves mailboxes or specific messages from Microsoft Exchange servers and filters emails for collection.T1560 · Archive Collected DataSelected emails are compressed before being staged and exfiltrated.
People
Threat Actors
Malware
Products
Microsoft Active DirectoryThe commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets;Microsoft Exchangea previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
Countries
Kazakhstanfor long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.Romaniaintelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.RussiaThe Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with