# ESET details Turla malware that intercepts government Exchange email

_Published Tuesday, November 10, 2026 at 6:01 AM EST · Security · Latest · Tier 2 — Notable_

![ESET details Turla malware that intercepts government Exchange email — Primary](https://www.bleepstatic.com/content/hl-images/2026/05/15/Russia.jpg)

ESET has disclosed a malicious toolset called Cereal that it attributes to Russian state-backed hackers Turla. Researchers found it on government Exchange servers in Kazakhstan and Romania in late 2025. In Romania, it selectively collected correspondence with NATO and EU representatives.

One component intercepts email inside an existing Exchange process without registering a new transport agent or interrupting delivery. Another receives encrypted commands through web requests resembling legitimate Exchange traffic. ESET observed no external command infrastructure; the compromised server itself served as the control point.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/)

---
Canonical: https://techandbusiness.org/newswire/7idkMAOo6v0FBxF1frdHTd
Published: 2026-11-10T11:01:31.518Z
Story chronology: 2026-11-10T10:04:32.000Z
Retrieved: 2026-11-10T13:26:12.910Z
Publisher: Tech & Business (techandbusiness.org)