Turla's Cereal: Exchange server malware

Microsoft Exchange servers

Russian group Turla used new toolset to pilfer emails

Do this now

Check Microsoft's advisory for a fix to the Turla Exchange malware and restrict access to Exchange servers meanwhile.

Who should check: teams running Microsoft Office

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 21:17 UTC
Source: news
On the menu as: Microsoft Office

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Turla's Cereal: Exchange server malware
Severity: unknown. Patch status: fix status unknown.
Affected: Microsoft Exchange servers

Russian group Turla used new toolset to pilfer emails

## Steps
1. This touches infrastructure (office). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. No source names a fix yet; check the vendor advisory. Until one ships: restrict network access to it.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhstan-romanian-governments/ https://www.helpnetsecurity.com/2026/11/10/eset-turla-exchange-malware/ https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html https://www.infosecurity-magazine.com/news/turla-cereal-exchange-email/ https://securityaffairs.com/202800/apt/russia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room.html https://databreaches.net/2026/11/11/eset-links-cereal-to-turla-in-romanian-server-breach-case-defense-news/
https://pwned.coffee/i/turla-s-cereal-exchange-server-malware

Timeline

10 Nov 2026, 21:17 UTC
Reported by securityaffairs.com: Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room
10 Nov 2026, 15:17 UTC
Reported by infosecurity-magazine.com: Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails
10 Nov 2026, 11:17 UTC
Reported by thehackernews.com: Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
10 Nov 2026, 10:17 UTC
Reported by helpnetsecurity.com: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Score: No CVSS published yet: severity unknown.
Last checked: 13 Nov 2026, 16:26 UTC

Sources: KEV – CVE record – Vendor –

Sources

Follow on X

Totalone coffee