TechCapsules

AI-summarised brief · reviewed before publication

Turla, a Russia‑aligned threat actor, deployed a new, undocumented malware suite called Cereal to infiltrate Microsoft Exchange servers and covertly harvest emails. The modular, in‑memory toolset, observed against Kazakhstan and Romanian government entities in late 2025, avoids disk footprints and external infrastructure, embedding itself within legitimate Exchange processes. Cereal’s components collect targeted messages, compress and encrypt them, then exfiltrate data via encrypted channels. The operation demonstrates Turla’s deep technical knowledge of Exchange and its strategic focus on NATO and EU communications.