Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called…
Why am I seeing this Ranked on source trust — BleepingComputer
It ranks mainly on source trust: BleepingComputer is the most reliable outlet we track on this subject, and is the only one on the story so far.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 34% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 0.65 | +0.163 41% | BleepingComputer is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.48 | +0.095 24% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
Turla, a Russian state-backed threat group, has deployed a previously unknown malware called Cereal to compromise Microsoft Exchange servers at government organizations. The toolset is designed to intercept and collect emails from compromised systems. Exploitation has been confirmed in active attacks against government targets.
Cereal functions as a modular cyber espionage tool built specifically to infiltrate Exchange servers and extract email communications. The malware operates with sophistication, allowing attackers to access sensitive correspondence from targeted government entities. The toolset represents an expansion of Turla's capabilities for conducting persistent surveillance operations.
The source material does not specify defensive measures or remediation steps that organizations should take in response to this threat.
What happened
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Bleepingcomputer first seen Turla hackers use new Cereal malware to spy on govt Exchange servers
- 02 Feedburner +0m Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Server
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.