The Russian state-backed hacking group Turla has recently been identified as using a new malicious toolset known as 'Cereal' to compromise Microsoft Exchange servers at government organizations. This sophisticated malware allows the group to intercept emails and spy on communications, significantly increasing their surveillance capabilities against targeted entities.

According to ESET researchers, the Cereal malware has been deployed on Microsoft Exchange servers in at least two government organizations, one located in Kazakhstan and the other in Romania. This modular .NET toolset enables the attackers to copy selected emails directly from the mail flow without needing an attacker-owned server, thereby enhancing the stealth and effectiveness of their operations.S2

The operation involves sending commands to the victim's internet-facing Exchange server, disguised as regular traffic from Outlook Web Access, Autodiscover, and ActiveSync. This method not only conceals the malicious activity but also allows the attackers to maintain control over the compromised servers without raising alarms, making it a significant threat to the integrity of government communications in the affected countries.S2