Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers Ravie LakshmananNov 10, 2026Cyber Espionage / Malware The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025. "The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," the Slovakian cybersecurity company said. "It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes." "The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft." The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest. The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks. Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object's state into a format that can be easily stored, transmitted, and reconstructed. A number of aspects make the malware stand apart - Absence of an external command-and-control (C2) infrastructure, instead abusing a compromised Exchange server for this purpose. Sending commands in the form of separate, compiled .NET programs. Using an automated email collection module, which is injected into legitimate Microsoft Exchange processes and is engineered to manipulate the email transport pipeline. The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added. The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data - CerealRunner, which is deployed by the operator and serves as a pathway for dropping additional components, including CerealLoader, CerealSprinter, CerealIron, and CerealMoth. CerealLoader, which loads and runs a .NET assembly from an encrypted file on disk, leading to the execution of CerealSprinter. CerealSprinter, which functions similarly to CerealRunner and is used to decrypt and run CerealNeuron, CerealHermit, and CerealBox. CerealIron, an injector that makes it possible to load and run .NET assemblies from non .NET processes. CerealMoth, which receives an assembly and a method name as inputs, loads the assembly, and runs the specified method. CerealNeuron, a passive backdoor that runs on a compromised Exchange Server and listens for incoming web requests on paths that appear like regular Exchange traffic to execute assemblies contained in CerealRunner binaries. CerealHermit, a variant of CerealNeuron that reads commands from encrypted files on disk and has no network functionality of its own. CerealBox, which is the email harvesting module that processes, filters, and collects email messages by injecting itself into the Exchange transport service ("EdgeTransport.exe"). Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names. Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands. In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia's strategic priorities. The commands delivered as compiled .NET programs are handled by CerealRunner, which unpacks and executes the payloads in memory and then sends the results back to CerealNeuron for subsequent exfiltration to the threat actor in encrypted format. The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations. "The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands," ESET researcher Matías Porolli said. "Combined with a codebase built around modular, interchangeable components, the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, email security, Malware, Nation-State, Windows Security Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Flood is Coming And The Pipes Were Already Full Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk