Russian Spies Deploy Stealthy 'Cereal' Malware to Harvest Government Emails

A Russian state-sponsored hacking group known as Turla (or Snake) has been caught using a sophisticated new espionage toolkit called 'Cereal' to infiltrate Microsoft Exchange email servers belonging to government agencies. According to an ESET report, the malware is designed for long-term, stealthy intelligence gathering and has already been deployed against government entities in Kazakhstan and Romania. The toolset cleverly avoids using external command-and-control servers, instead hiding within legitimate Exchange processes to collect emails of interest with minimal forensic footprint.

The Cereal framework is a modular collection of eight components that can map infected networks, execute commands in memory, and automatically harvest emails by manipulating the Exchange transport pipeline. This shows Turla's deep understanding of Microsoft's email server software, turning it into a durable collection point and internal execution hub. For organizations relying on Exchange, especially in government and sensitive sectors, this represents a significant escalation in stealthy, server-level espionage that traditional perimeter defenses might miss completely.