Russian Turla group uses Cereal toolset on government servers

Russian cyberespionage group Turla has deployed a new modular toolset called 'Cereal' to target government Exchange servers in Kazakhstan and Romania. The malware exploits legitimate Microsoft Exchange, Windows, and .NET functions to silently pilfer emails. Notably, it repurposes compromised Exchange servers as command-and-control infrastructure, avoiding external C&C detection. Organizations running Exchange servers should review access logs and implement email security monitoring.