Security AlertHigh
Turla uses new Cereal malware to spy on government Exchange servers
Nov 10, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Turla is using a new toolset called Cereal to collect emails from Microsoft Exchange servers. ESET saw it in government organisations in Kazakhstan and Romania.
Key points
- ESET found the malware in late 2025.
- The attacks targeted government entities in Kazakhstan and Romania.
- Cereal can harvest emails and run commands in memory.
Why it matters
Government-style attack methods often spread to other sectors. If your organisation runs Exchange, this shows why server hardening, patching and email monitoring matter for business email and sensitive records.
Who’s affected: Microsoft Exchange servers in government organisations
What to do
- Patch and harden Microsoft Exchange servers.
- Review Exchange logs for unusual in-memory activity.
- Watch for phishing or watering-hole style access attempts.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.