ESET says Russia's Turla hid new 'Cereal' malware inside government Exchange servers to ...

ESET attributes the Cereal toolset to Turla with high confidence; it found it at a Kazakh government body in November 2025 and a Romanian government agency compromised on Dec. 23, 2025 [1] .

Cereal hijacks transport agents already loaded in Exchange's EdgeTransport.exe to copy selected email, a technique ESET says has not been documented for any malware family [1] .

There is no external command-and-control server: operators send encrypted commands to the victim's own internet-facing Exchange server [1] .

The Russian cyber-espionage group Turla has been using a new malware toolset called Cereal to read email on government Microsoft Exchange servers, according to research ESET published on Tuesday, Nov. 10 [1] . ESET, a Slovakia-based security company, attributes Cereal to Turla with "high confidence," based on the concurrent use of another component publicly linked to the group and similarities to older Turla malware [1] . Turla, also tracked as Snake and Secret Blizzard, is "widely assessed to be part of Russia's Federal Security Service," ESET wrote [1] .

ESET found Cereal at a governmental organization in Kazakhstan on Nov. 28, 2025, and, after tuning its detections, at a Romanian government agency that was compromised on Dec. 23, 2025 [1] . In Romania, the email-stealing module was configured to collect messages sent to or from NATO and European Union addresses [1] [2] . ESET said 70% of the countries Turla has targeted since 2022 are former Soviet republics or European states once closely aligned with the USSR [1] .

How it hooks Exchange

Cereal is a modular set of .NET components with names such as CerealBox, CerealNeuron and CerealRunner [1] . CerealBox does the email theft. Turla has used Exchange transport agents before, but registering one leaves configuration traces; CerealBox is instead injected into EdgeTransport.exe, the Exchange process that handles mail flow, where it wraps the handlers of transport agents already loaded in memory [1] . Its code runs first and then passes control back, so mail keeps flowing [1] . It copies messages that carry .doc, .docx or .pdf attachments and match hardcoded sender, recipient, subject or file-name lists, then compresses, encrypts and stages them on disk for later collection [1] . "Injecting into the Exchange transport service and hooking mail flow from within is a novel technique, not previously documented for any malware family," wrote ESET researcher Matías Porolli [1] .

CerealNeuron, named after Turla's older Neuron malware, is a passive backdoor: it never calls out, and instead waits for encrypted web requests on paths that imitate Exchange services such as Outlook on the web, Autodiscover and ActiveSync, redirecting malformed requests to a normal-looking Exchange error page [1] . Each command arrives as a small, separately compiled .NET program that can pull mailboxes through Exchange Web Services, query Active Directory, extract LSA secrets or read and delete files [1] . A variant, CerealHermit, has no network functions and reads encrypted commands from disk [1] . ESET found no attacker-controlled external infrastructure and could not identify the operators' IP addresses; "the victim's own internet-facing Exchange server is the operator-accessible control point," it wrote [1] .

To load, Cereal uses DLL hijacking, including a malicious wbemcomn.dll in the Windows WMI folder that forwards legitimate calls so the host keeps working, and plants files in the .NET native image cache under names such as Microsoft.Exchange. .Mdb.ni.dll so the runtime loads them in place of genuine Exchange libraries [1] . ESET did not say how Turla first got into either network [1] . The sheer number of near-identical, task-specific binaries suggests an internal framework that automates building commands, ESET said, calling the codebase "a mature, well-engineered platform" [1] [2] . Indicators of compromise are on ESET's GitHub repository [3] .