Malware
CerealBox
- First Reported
- Nov 10, 2026
- Latest Reported
- Nov 10, 2026
Reported Context (2)
- analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. Turla Uses Cereal Malware to Spy on Government Exchange Servers
- The Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses. ESET Uncovers Turla-Linked Cereal Toolset Targeting Exchange Servers
Malware (8)
Threat Actors (1)
MITRE ATT&CK (17)
Vendors (1)
Products (4)
Industries (3)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.