Russian-linked espionage group Turla has deployed a previously undocumented .NET malware toolkit that turns compromised Microsoft Exchange servers into surveillance platforms and command infrastructure.
Named Cereal, the modular toolset intercepts selected emails while allowing legitimate messages to continue through the transport pipeline, concealing intelligence collection inside routine government communications.
ESET disclosed the findings on November 10, 2026, following detection at a governmental organization in Kazakhstan on November 28, 2025.
Researchers subsequently identified the toolkit at a Romanian governmental organization compromised from December 23, 2025.
Researchers attributed Cereal to Turla with high confidence, citing concurrent deployment of a previously attributed bootstrapper and functional similarities with older Turla tooling.
Initial access remains undetermined; exploitation of an internet-facing Exchange vulnerability is a possibility , not a confirmed infection vector.
CerealNeuron, the toolkit’s passive backdoor, waits for incoming HTTPS requests rather than periodically contacting an external command server.
Observed listener paths included /owa/sdds/ , /AUTODISCOVER/PROXYSERVICE/ , and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/ , placing malicious requests alongside recognizable Exchange web-service traffic.
Requests passing encryption and integrity checks deliver executable commands; invalid requests receive redirects to legitimate-looking Exchange error pages.
ESET observed no dedicated external command-and-control infrastructure and could not identify the operators’ ingress IP addresses.
ESET Researchers said that , In Romania, collection rules targeted correspondence involving NATO and European Union institutional addresses, including nato.int and europa.eu.
Microsoft Exchange Abuse
The victim’s own server therefore becomes the accessible control point, limiting infrastructure-based tracking and blocking opportunities.
Operators package individual tasks as compiled .NET assemblies inside CerealRunner containers.
Payloads decrypt and execute in memory, supporting mailbox retrieval through Exchange Web Services, Active Directory reconnaissance, WMI queries, LSA Secrets extraction, snapshot enumeration, and file operations.
CerealHermit provides an alternative channel by reading encrypted commands from disk and writing encrypted results.
The surveillance component, CerealBox, is injected into EdgeTransport.exe , Exchange’s mail transport process.
Rather than registering a malicious transport agent, it locates existing agents in memory and wraps their handlers, executing collection logic before returning control to legitimate code.
Consequently, administrators inspecting registered transport agents would not see a newly installed agent.
Messages qualify for collection when they contain a .doc , .docx , or .pdf attachment and match configured sender, recipient, subject, or attachment-name criteria without matching exclusion rules.
Selected messages are compressed, encrypted, and staged locally. Operators subsequently retrieve and delete those files through CerealNeuron commands.
ESET describes this in-memory interception of Exchange’s transport pipeline as previously undocumented.
CerealLoader complicates analysis through unmanaged entry points and VTable Fixups, bridging native execution into malicious managed methods that conventional .NET inspection can overlook.
Other deployment chains hijack Windows DLL loading or abuse the .NET native image cache using filenames such as Microsoft.Exchange. .Mdb.ni.dll , while preserving legitimate application functionality.
The campaign extends an established operational pattern. ESET’s analysis links Cereal conceptually to LightNeuron, Turla’s earlier Exchange backdoor, which received commands hidden in email attachments.
Separately, ESET documented Gamaredon deploying or restarting Turla’s Kazuar implants in Ukraine during 2025, illustrating cooperation between the FSB-associated groups without establishing Gamaredon involvement in Cereal.web-assets.
For defenders, the findings highlight a visibility gap: normal mail delivery, an unchanged transport-agent inventory, and no observed external beaconing can coexist with active espionage.
Investigations therefore need visibility into process memory and unexpected module loads, alongside Exchange web requests and encrypted staging files.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .
Artificial Intelligence
Cyber security Course
Cyber Security Resources
Cybersecurity
Information Gathering
Information Security Risks
Weekly Cybersecurity – Top 50 Biggest Cybersecurity Stories of the Week
One Identity Unveils Safeguard 9.0 for Simpler PAM
One Identity Unveils Active Roles 8.6 with Enhanced Security and Administration
One Identity Unveils Identity Manager 10.0 LTS with AI and Modern UX
OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP
Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
