Turla hackers use new Cereal malware to spy on govt Exchange servers

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan.

A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU).

"After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today.

Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).

In the campaign analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers.

The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery in the Exchange server.

Turla configured the malware to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files, and match certain sender, recipient, and subject criteria.

Another malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution.

CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute.

Commands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files.

“The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands,” ESET says the disposable programs serving as command carriers.

“Combined with a codebase built around modular, interchangeable components, the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts.”

The CerealRunner components contain encrypted .NET programs and the arguments needed to run them, which execute in the host’s memory and then return their output to CerealNeuron.

Eventually, CerealNeuron encrypts the output and sends it back to the attackers.

ESET observed no external command-and-control (C2) infrastructure used in the attack, leaving the compromised Exchange server itself to serve as the only control point.

The researchers also uncovered a variant of CerealNeuron called CerealHermit, which lacks network capabilities and instead reads commands from encrypted files on the disk.

CerealHermit may serve as a fallback/redundancy system for when Neuron’s web channel becomes unavailable. However, ESET didn’t explain how attackers place Hermit’s command files on the server or retrieve the execution results.

The researchers note that Cereal’s advanced concealment methods demonstrate Turla’s deep understanding of .NET execution techniques, including abusing the .NET native image cache to run inside legitimate processes.

ESET says the Cereal toolset was designed for "long-term, stealthy cyberespionage," featuring a small disk footprint and relying on infrastructure that is less likely to be detected and blocked.

The company has shared a complete list of indicators of compromise on its GitHub page.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.