Type Research & news
Microsoft
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
1 source
At a glance
Low
MonitorNo fixed deadline
Evidence-weighted, not popularity
Why Low
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. The summary below says what is known so far.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
No technical write-up beyond the summary below yet.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- Exploitation in the wild is not confirmed; treat this as a prioritisation signal.
Products and services involved
- Microsoft Exchange94% match confidence
20 reports
Part of Microsoft and Node.js vulnerability disclosures
- Turla hackers use new Cereal malware to spy on govt Exchange servers
- Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix
- Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
- Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways
Pulse
Last change 2h ago · Next recheck 11 Nov 2026, 11:18 UK time
- Story10 Nov 2026, 11:18 UK time · 2h ago
Linked reporting from The Hacker News (independent original reporter).
Read source (The Hacker News)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- The Hacker NewsNews
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers