ESET found a new Turla toolset it calls Cereal, used against government targets in Kazakhstan and Romania in late 2025. The Hacker News covered the report.
What it does
Cereal is modular .NET tooling that lives inside legitimate Exchange processes. It takes commands, runs them in memory, maps the network and harvests the emails it’s told to look for. It leaves little on disk and doesn’t use outside infrastructure that defenders could block. The name comes from its heavy use of serialization. How they got in is still unknown. Turla’s known tricks include spear-phishing, watering holes and ISP-level man-in-the-middle.
My take
ESET says Turla treats Exchange servers as “durable collection points.” If you still run on-prem Exchange, keep it fully patched, watch for odd .NET modules and IIS changes, and pull ESET’s IoCs into your hunting. If you don’t truly need on-prem Exchange, this is one more reason to retire it.
God Bless, and Happy hacking!
