Turla Deploys Cereal to Spy on Exchange Emails

The group Turla, linked to Russia and also known as Snake, has returned to the front line with a new arsenal. According to the ESET report shared in advance with The Hacker News, the actor is using a previously undocumented tool called Cereal, designed specifically to break into Microsoft Exchange servers and collect victims' emails without drawing attention. This is not a generic trojan: Cereal is a modular set, which in practice means that its operators can add, remove, or adapt components depending on the target in front of them.

What Cereal is and why it matters

Email remains the crown jewel of any organization. It holds conversations with clients, contracts, invoices, internal threads where decisions are hashed out and, of course, credentials that are shared all too readily. An attacker who manages to read a company's email does not need to encrypt anything to cause harm: it is enough to observe, wait for the right moment, and act.

Turla's approach fits that logic of patience. Cereal is designed to collect emails stealthily, not to put on a show. And the fact that it targets Exchange servers is especially relevant for SMBs, because on-premise Exchange (or poorly documented hybrid environments) remains a very widespread reality in the Spanish business fabric.

It is worth recalling the context: Turla is not a group of opportunists launching mass campaigns against anyone. It is an espionage actor with resources, patience, and selected targets. That does not mean an SMB will be its main target, but it does mean that the techniques it uses eventually leak into the broader criminal ecosystem. What is state espionage today is mid-range ransomware tomorrow.

The lesson for an IT team with limited resources

We are not going to ask a twenty-employee SMB to set up a security operations center. That would be absurd. But we can draw practical consequences from a case like this:

• Exchange is not a household appliance. If you have an on-premise Exchange server, it needs disciplined patching, configuration reviews, and someone who looks at the logs from time to time. If no one does, you have an open door with a sign that says “come in.”
• Email is a critical asset, not just another tool. It deserves the same level of protection as the billing database. Segmentation, multi-factor authentication for mailbox access, and centralized logging are reasonable minimums.
• Cereal's modularity is a warning. Attackers design tools that adapt. Defenses that cover only one specific vector fall short as soon as the adversary changes a component.
• Detection matters as much as prevention. Silent access to mailboxes can go unnoticed for months. Without monitoring for anomalous email behavior, you do not find out until it is too late.

What we recommend at ForgeNEX

To start, an honest inventory. What email servers do you have, where are they, who administers them, and what version are they running? Many SMBs discover during this exercise that they have a forgotten Exchange server in a closet, not updated for years, and that no one is quite sure who last touched it.

Then, prioritize. If corporate email is in Microsoft 365, much of the patching responsibility falls on the provider, but access configuration, MFA policies, and forwarding rules are still yours. And that is where attackers slip in: a misconfigured forwarding rule can send a copy of everything to an external mailbox without anyone noticing.

It is also worth reviewing the exposure surface. Does that Exchange server need to be accessible from the internet as is? Is there a reverse proxy in front of it? Are accesses logged and does anyone read them? These are simple questions that, in our experience, often have no clear answer.

Silent espionage is not detected with an antivirus. It is detected with visibility, logs, and someone who knows how to interpret them.

Finally, training. Email is the favorite entry vector because people click. A team that recognizes a phishing attempt and knows whom to alert is worth more than any tool. And if we add a basic response plan to that—whom to call, what to isolate first, how to communicate with clients—the difference between a scare and a disaster is enormous.

Cases like Turla and Cereal remind us of something uncomfortable: security is not a product you buy and forget, but a discipline you practice. For an SMB, that means choosing your battles well and not leaving the basics uncovered. If you want to go deeper into how we manage this type of risk, you can review our analysis of chained flaws that grant root access without login or the article on default credentials on identity servers. Both share a pattern: the basics, done badly, open the door to the serious.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.