helpnetsecurity.com/2026/11/10/eset-turla-exchange-malware Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
ESET discovered Cereal, a modular .NET toolset, on Microsoft Exchange servers at government organizations in Kazakhstan and Romania, with the Romanian victim compromised on December 23, 2025. The malware copied selected email from the mail flow and disguised command traffic as ordinary Exchange activity, and ESET attributes it to Turla with high confidence.
