Search — “Turla”
1 story · 0 IoCs
Stories
P2
Turla attempts espionage with Cereal malware injected into Exchange EdgeTransport.exe at government organizations
Russian state-linked group Turla deployed a modular .NET toolset called Cereal against government Exchange servers, documented by ESET in Kazakhstan and Romania. CerealBox injects into EdgeTransport.exe to hijack transport agent handlers and harvest selected email, while CerealNeuron receives encrypted web requests on Exchange-like paths and executes CerealRunner programs. ESET observed no external C2, so the compromised Exchange server served as the control point; hunters should look for unusual code in EdgeTransport.exe, encrypted web requests to Exchange-like paths, and the CerealRunner/CerealNeuron artifacts listed in ESET's GitHub IoCs.