Security AffairsPierluigi Paganini
Turla turns Exchange servers into covert control rooms
Part of the Turla story · since 19 Sep 2025
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
- Tue 10 Nov, 22:00 UTC. Security Affairs. Turla turns Exchange servers into covert control rooms. This article, 16th of 16.
ESET Research has detailed a new Turla operation, using a toolset named Cereal that targets Microsoft Exchange servers on government networks in Kazakhstan and Romania. The Cereal framework is modular .NET-based and arrives in encrypted form, unpacking in memory with only the initial loader stored as a regular .NET file.
A distinctive feature is that there is no attacker-controlled external server: the main backdoor, CerealNeuron, runs directly on the victim’s Exchange server and receives commands via web paths that mimic legitimate Outlook Web Access, Autodiscover and ActiveSync traffic. If requests fail encryption or security checks, the server returns a standard Exchange error page, making detection harder in firewall logs.
ESET notes additional components: a second version, CerealHermit, has no network functions and reads encrypted command files from disk; a companion module, CerealBox, injects into EdgeTransport.exe to access mail flow without registering new Exchange agents. The operators issue tasks via small compiled .NET programs called CerealRunner, enabling actions such as mailbox harvesting, Active Directory queries, WMI queries, and credential extraction.
Cereal’s operators reportedly operate primarily against former Soviet and European NATO/EU targets, with Romania and Kazakhstan cited explicitly. CISA attributes the activity to a Russia-nexus actor linked to Centre 16 of the FSB. Defenders are advised to look for unusual DLLs in the Windows management folder, stray files in the native image cache, and suspicious web-path requests used by the backdoor. ESET concludes that Exchange servers have become durable control rooms and internal execution hubs for Turla.
How the story developed
16 articles from 9 outlets since 19 Sep. Picked up again today after 7 weeks quiet. This was the 16th report, 418 days after the first.
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
- Tue 10 Nov, 22:00 UTC. Security Affairs. Turla turns Exchange servers into covert control rooms. This article, 16th of 16.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 16 articles as a listHide the list
- Fri 19 SepDay 03
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine08:56 · The Hacker News · First report
- Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions13:45 · SecurityWeek
Quiet for 2 days
Sun 21 SepDay 21- ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks18:15 · Security Affairs · Picked up again
Quiet for 34 weeks
Thu 14 MayDay 2371- Secret Blizzard’s Kazuar malware hits govts with P2P botnet15:10 · Microsoft · Picked up again
- Fri 15 MayDay 2381
- Turla’s Kazuar backdoor now powers stealthy peer to peer botnet17:50 · The Hacker News
- Sat 16 MayDay 2391
- Russian Turla Group Deploys P2P Kazuar Botnet for Stealth17:16 · Security Affairs
Quiet for 6 weeks
Thu 25 JunDay 2791- Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe15:32 · Google Cloud · Picked up again
- Fri 26 JunDay 2802
- Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine08:32 · The Hacker News
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets09:10 · SecurityWeek
Quiet for 4 days
Tue 30 JunDay 2841- STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 12 weeks
Wed 23 SepDay 3691- New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks14:38 · Infosecurity · Picked up again
Quiet for 7 weeks
Tue 10 NovDay 4174- Turla uses Cereal malware to steal emails from Exchange servers11:30 · The Hacker News · Picked up again
- AI Makes Reverse Engineering Software and Malware Easier13:30 · Dark Reading
- Turla spies on NATO and EU emails through Exchange servers15:00 · Infosecurity
- Turla turns Exchange servers into covert control rooms22:00 · Security Affairs · This article, 16th of 16