{"id":16863,"date":"2026-11-10T09:00:00","date_gmt":"2026-11-10T08:00:00","guid":{"rendered":"https:\/\/safewave.ai\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/"},"modified":"2026-11-12T02:06:30","modified_gmt":"2026-11-12T01:06:30","slug":"turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure","status":"publish","type":"post","link":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/","title":{"rendered":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"16863\" class=\"elementor elementor-16863 elementor-16847\" data-elementor-post-type=\"post\">\n\t\t\t\t<header class=\"elementor-element elementor-element-69a6236 e-flex e-con-boxed e-con e-parent\" data-id=\"69a6236\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-69a7cac elementor-widget elementor-widget-heading\" data-id=\"69a7cac\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<p class=\"elementor-heading-title elementor-size-default\"><a href=\"https:\/\/safewave.ai\/en\/soc-xdr-and-threat-intelligence\/\">SOC, XDR, and Threat Intelligence<\/a><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69a7f76 elementor-widget elementor-widget-heading\" data-id=\"69a7f76\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69a72db elementor-widget elementor-widget-text-editor\" data-id=\"69a72db\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>On November 10, 2026, ESET published an analysis of a .NET toolset dubbed Cereal, attributed with high confidence to the Russia-aligned Turla group. The tools operated on Microsoft Exchange servers at two government institutions in Kazakhstan and Romania, copying selected messages from the mail flow.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-69a7f83 elementor-widget elementor-widget-html\" data-id=\"69a7f83\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<ul class=\"sw-meta\"><li><span>Source<\/span><a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids\/\" target=\"_blank\" rel=\"noopener\">ESET<\/a><\/li><li><span>Source publication<\/span>November 10, 2026<\/li><li><span>Type<\/span>Threats and incidents<\/li><\/ul>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/header>\n\t\t<article class=\"elementor-element elementor-element-69a7768 e-flex e-con-boxed e-con e-parent\" data-id=\"69a7768\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-69a7465 elementor-widget elementor-widget-text-editor\" data-id=\"69a7465\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What happened<\/h2><p>ESET discovered Cereal on November 28, 2025, on an Exchange server of a Kazakh government institution. A Romanian institution was compromised on December 23, 2025. Researchers have not determined the initial entry vector.<\/p><p><strong>C2-less command and control.<\/strong> The primary backdoor, CerealNeuron, does not connect to any external infrastructure. It listens on the Exchange server itself using paths mimicking legitimate ones, such as \/owa\/sdds\/ and \/autodiscover\/proxyservice\/. A correctly encrypted request is executed as a command; any other request receives a standard Exchange error page. ESET was unable to identify the operators&#8217; IP addresses.<\/p><p><strong>Email collection.<\/strong> The CerealBox module injects into the EdgeTransport.exe process (the Exchange transport service). It intercepts messages with .doc, .docx, or .pdf attachments that match predefined lists of senders, recipients, subjects, or filenames. Copies are compressed, encrypted, and stored on disk for later retrieval. In Romania, the module was configured to target correspondence with NATO and EU institutional addresses.<\/p><h2>Key findings<\/h2><ul><li>Eight components, including CerealLoader, CerealNeuron, CerealHermit (a network-less variant executing commands from local files), and CerealBox.<\/li><li>The loader masquerades as ncobjapi.dll and wbemcomn.dll in the C:\\Windows\\System32\\wbem\\ directory.<\/li><li>Malicious files were also placed in the .NET native image cache, e.g., as Microsoft.Exchange.Search.Mdb.ni.dll.<\/li><li>Attribution: Turla, with high confidence, based, among other things, on the use of a component previously publicly linked to the group.<\/li><li>ESET has released indicators of compromise (IoCs) in its GitHub repository.<\/li><\/ul><h2>Why it matters<\/h2><div class=\"sw-take\"><span class=\"sw-take__k\">SafeWave Commentary<\/span>This operation bypasses two common detection points. There are no connections to a C2 server, rendering blocklists and outbound traffic analysis ineffective. Furthermore, no new transport agent is installed, as the module hooks into existing ones. Detection relies on server-side activity. For those maintaining on-premises Exchange: compare the contents of the wbem directory and .NET native image cache with ESET&#8217;s indicators; cover the Exchange server with EDR monitoring in the same way as admin workstations; review IIS logs for requests to unusual paths under \/owa\/, \/autodiscover\/, and \/microsoft-server-activesync\/; identify personnel corresponding with EU and NATO institutions and treat those mailboxes as high-risk targets. Institutions and companies in Poland that maintain such correspondence fit the victim profile described by ESET. More: <a href=\"https:\/\/safewave.ai\/en\/soc-xdr-and-threat-intelligence\/\">SOC, XDR, and Threat Intelligence<\/a>.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/article>\n\t\t<aside class=\"elementor-element elementor-element-69a7d8c e-flex e-con-boxed e-con e-parent\" data-id=\"69a7d8c\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-69a7f4a elementor-widget elementor-widget-text-editor\" data-id=\"69a7f4a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"sw-h\">Source<\/p><ul class=\"sw-src\"><li><a href=\"https:\/\/www.welivesecurity.com\/en\/eset-research\/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids\/\" target=\"_blank\" rel=\"noopener\">ESET \u2013 Exchange for breakfast: Turla\u2019s Cereal tricks are not for kids<\/a><\/li><li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/10\/eset-turla-exchange-malware\/\" target=\"_blank\" rel=\"noopener\">Help Net Security \u2013 Turla\u2019s Cereal malware turns victims\u2019 Exchange servers into spy hubs<\/a><\/li><li><a href=\"https:\/\/github.com\/eset\/malware-ioc\/tree\/master\/turla\" target=\"_blank\" rel=\"noopener\">ESET \u2013 Turla: indicators of compromise (GitHub)<\/a><\/li><\/ul><p class=\"sw-rel\"><a href=\"https:\/\/safewave.ai\/en\/soc-xdr-and-threat-intelligence\/\">Area: SOC, XDR, and Threat Intelligence \u2192<\/a><a href=\"https:\/\/safewave.ai\/en\/technology-intelligence\/\">All analyses \u2192<\/a><\/p><p class=\"sw-asof\">SafeWave editorial analysis based on the cited source. Facts come from the source; the &#8220;Why it matters&#8221; section is our commentary.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/aside>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>ESET describes Turla group&#8217;s Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"footnotes":""},"categories":[259],"tags":[],"class_list":["post-16863","post","type-post","status-publish","format-standard","hentry","category-soc-xdr-threat-intelligence"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave<\/title>\n<meta name=\"description\" content=\"ESET describes Turla group&#039;s Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave\" \/>\n<meta property=\"og:description\" content=\"ESET describes Turla group&#039;s Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/\" \/>\n<meta property=\"og:site_name\" content=\"SafeWave\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T08:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-12T01:06:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/safewave.ai\/wp-content\/uploads\/2026\/11\/safewave-cybersecurity-x-ai-1200x630-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"SafeWave\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"SafeWave\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/\"},\"author\":{\"name\":\"SafeWave\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/person\\\/9e9fc64ff61c418abb6f658be85dcf4a\"},\"headline\":\"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure\",\"datePublished\":\"2026-11-10T08:00:00+00:00\",\"dateModified\":\"2026-11-12T01:06:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/\"},\"wordCount\":511,\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"articleSection\":[\"SOC, XDR i Threat Intelligence\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/\",\"name\":\"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\"},\"datePublished\":\"2026-11-10T08:00:00+00:00\",\"dateModified\":\"2026-11-12T01:06:30+00:00\",\"description\":\"ESET describes Turla group's Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"name\":\"SafeWave\",\"description\":\"We protect people, data and AI.\",\"publisher\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\"},\"alternateName\":\"SafeWave sp. z o.o.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/safewave.ai\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#organization\",\"name\":\"SafeWave\",\"alternateName\":\"SafeWave sp. z o.o.\",\"url\":\"https:\\\/\\\/safewave.ai\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"contentUrl\":\"https:\\\/\\\/safewave.ai\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/SafeWave-BLACK_350.png\",\"width\":350,\"height\":270,\"caption\":\"SafeWave\"},\"image\":{\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/safewave-ai\",\"https:\\\/\\\/www.youtube.com\\\/@SafeWaveAI\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/safewave.ai\\\/en\\\/#\\\/schema\\\/person\\\/9e9fc64ff61c418abb6f658be85dcf4a\",\"name\":\"SafeWave\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g\",\"caption\":\"SafeWave\"},\"description\":\"Zesp\u00f3\u0142 SafeWave \u2013 cyberbezpiecze\u0144stwo i AI dla firm od 1998 roku. Analizy Technology Intelligence przygotowujemy z pomoc\u0105 AI i weryfikujemy redakcyjnie.\",\"sameAs\":[\"https:\\\/\\\/safewave.ai\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave","description":"ESET describes Turla group's Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/","og_locale":"en_US","og_type":"article","og_title":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave","og_description":"ESET describes Turla group's Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.","og_url":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/","og_site_name":"SafeWave","article_published_time":"2026-11-10T08:00:00+00:00","article_modified_time":"2026-11-12T01:06:30+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/safewave.ai\/wp-content\/uploads\/2026\/11\/safewave-cybersecurity-x-ai-1200x630-1.png","type":"image\/png"}],"author":"SafeWave","twitter_card":"summary_large_image","twitter_misc":{"Written by":"SafeWave","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/#article","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/"},"author":{"name":"SafeWave","@id":"https:\/\/safewave.ai\/en\/#\/schema\/person\/9e9fc64ff61c418abb6f658be85dcf4a"},"headline":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure","datePublished":"2026-11-10T08:00:00+00:00","dateModified":"2026-11-12T01:06:30+00:00","mainEntityOfPage":{"@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/"},"wordCount":511,"publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"articleSection":["SOC, XDR i Threat Intelligence"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/","url":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/","name":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure &#8211; SafeWave","isPartOf":{"@id":"https:\/\/safewave.ai\/en\/#website"},"datePublished":"2026-11-10T08:00:00+00:00","dateModified":"2026-11-12T01:06:30+00:00","description":"ESET describes Turla group's Cereal toolset: an Exchange transport service module exfiltrated government emails in Kazakhstan and Romania.","breadcrumb":{"@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/safewave.ai\/en\/turla-and-the-cereal-toolset-exchange-server-backdoor-copies-government-emails-without-dedicated-infrastructure\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/safewave.ai\/en\/"},{"@type":"ListItem","position":2,"name":"Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure"}]},{"@type":"WebSite","@id":"https:\/\/safewave.ai\/en\/#website","url":"https:\/\/safewave.ai\/en\/","name":"SafeWave","description":"We protect people, data and AI.","publisher":{"@id":"https:\/\/safewave.ai\/en\/#organization"},"alternateName":"SafeWave sp. z o.o.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/safewave.ai\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/safewave.ai\/en\/#organization","name":"SafeWave","alternateName":"SafeWave sp. z o.o.","url":"https:\/\/safewave.ai\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/","url":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","contentUrl":"https:\/\/safewave.ai\/wp-content\/uploads\/2022\/05\/SafeWave-BLACK_350.png","width":350,"height":270,"caption":"SafeWave"},"image":{"@id":"https:\/\/safewave.ai\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/safewave-ai","https:\/\/www.youtube.com\/@SafeWaveAI"]},{"@type":"Person","@id":"https:\/\/safewave.ai\/en\/#\/schema\/person\/9e9fc64ff61c418abb6f658be85dcf4a","name":"SafeWave","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/65abcb7733e8dc7978eef52261952bdb2d6b542553675327aa0a3cfc74ee68bf?s=96&d=mm&r=g","caption":"SafeWave"},"description":"Zesp\u00f3\u0142 SafeWave \u2013 cyberbezpiecze\u0144stwo i AI dla firm od 1998 roku. Analizy Technology Intelligence przygotowujemy z pomoc\u0105 AI i weryfikujemy redakcyjnie.","sameAs":["https:\/\/safewave.ai"]}]}},"_links":{"self":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/comments?post=16863"}],"version-history":[{"count":2,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16863\/revisions"}],"predecessor-version":[{"id":16869,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/posts\/16863\/revisions\/16869"}],"wp:attachment":[{"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/media?parent=16863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/categories?post=16863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/safewave.ai\/en\/wp-json\/wp\/v2\/tags?post=16863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}