The Hacker Newsinfo@thehackernews.com (The Hacker News)
Turla uses Cereal malware to steal emails from Exchange servers
Part of the Turla story · since 19 Sep 2025
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers. This article, 13th of 15.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
The Hacker News reports that the Turla threat group, also known as Snake and aligned with Russian interests, has developed a new cyber espionage toolset named Cereal. According to an ESET briefing shared with The Hacker News, Cereal is a modular framework designed to break into Microsoft Exchange servers and covertly harvest emails for long‑term intelligence collection.
The toolset has been observed in two government entities in Kazakhstan and Romania during late 2025, with ESET noting its thorough stealth: minimal on‑disk footprint, avoidance of external C2 infrastructure, and concealment within legitimate Exchange processes. The report emphasises that for Turla, Exchange servers operate as durable collection points and internal execution hubs rather than simply mail servers.
Cereal is described as eight interconnected components that run on Exchange servers, enabling in‑memory execution, network mapping, and email exfiltration. The components include CerealRunner (dropping other parts such as CerealLoader, CerealSprinter, CerealIron, and CerealMoth), and CerealBox (the email harvesting module injecting into EdgeTransport.exe).
Other parts—CerealNeuron and CerealHermit act as backdoors/command readers, while CerealLoader, CerealSprinter, and CerealIron handle loading and executing .NET payloads in various contexts. The system targets messages with DOC/DOCX or PDF attachments, filtering by sender, recipient, subject, or attachment name, then compressing and encrypting the results for exfiltration via CerealNeuron. In the Romanian government case, CerealBox was configured to gather NATO and EU‑related emails.
ESET’s Matías Porolli described the toolset as a mature, well‑engineered platform rather than a scattered collection of scripts. The initial delivery vector remains unknown, though Turla is known to employ spear‑phishing, watering hole, and ISP‑level AITM techniques.
How the story developed
15 articles from 9 outlets since 19 Sep. Picked up again today after 7 weeks quiet. This was the 13th report, 417 days after the first.
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers. This article, 13th of 15.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 15 articles as a listHide the list
- Fri 19 SepDay 03
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine08:56 · The Hacker News · First report
- Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions13:45 · SecurityWeek
Quiet for 2 days
Sun 21 SepDay 21- ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks18:15 · Security Affairs · Picked up again
Quiet for 34 weeks
Thu 14 MayDay 2371- Secret Blizzard’s Kazuar malware hits govts with P2P botnet15:10 · Microsoft · Picked up again
- Fri 15 MayDay 2381
- Turla’s Kazuar backdoor now powers stealthy peer to peer botnet17:50 · The Hacker News
- Sat 16 MayDay 2391
- Russian Turla Group Deploys P2P Kazuar Botnet for Stealth17:16 · Security Affairs
Quiet for 6 weeks
Thu 25 JunDay 2791- Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe15:32 · Google Cloud · Picked up again
- Fri 26 JunDay 2802
- Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine08:32 · The Hacker News
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets09:10 · SecurityWeek
Quiet for 4 days
Tue 30 JunDay 2841- STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 12 weeks
Wed 23 SepDay 3691- New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks14:38 · Infosecurity · Picked up again
Quiet for 7 weeks
Tue 10 NovDay 4173- Turla uses Cereal malware to steal emails from Exchange servers11:30 · The Hacker News · Picked up again · This article, 13th of 15
- AI Makes Reverse Engineering Software and Malware Easier13:30 · Dark Reading
- Turla spies on NATO and EU emails through Exchange servers15:00 · Infosecurity