Cereal malware lets Turla steal Exchange emails from governments
A Russia-aligned state-sponsored actor known as Turla, also called Snake, is using a previously undocumented toolset named Cereal to break into Microsoft Exchange servers and collect emails. ESET says the modular espionage framework was seen against two governmental entities in Kazakhstan and Romania in late 2025. How the Cereal toolset is described ESET describes Cereal as a long-term cyber espionage system built to stay quiet and remain on Exchange servers.…