Turla’s Cereal malware turns Microsoft Exchange servers into covert espionage hubs

The Russian-linked cyberespionage group Turla has been using a previously undocumented malware framework to collect sensitive government correspondence from Microsoft Exchange servers. The activity, uncovered by ESET, involved government organisations in Kazakhstan and Romania and illustrates how attackers can exploit the very systems responsible for handling secure communications.

Detailed in ESET's research report published on 10 November 2026 , the framework, named Cereal, operates within legitimate Exchange processes rather than relying on a conventional, externally controlled malware implant.

ESET first identified the toolkit in Kazakhstan in November 2025. A subsequent investigation uncovered another deployment at a Romanian government agency in December, where the malware was configured to collect correspondence involving NATO and European Union institutions.

The targeting is consistent with Turla's established focus on government and diplomatic intelligence. The group's operations have long been associated with Russia's Federal Security Service (FSB).

Exploiting Exchange from within

Cereal's effectiveness stems from its access to Exchange's internal mail-processing architecture. Its CerealBox component operates inside EdgeTransport.exe , the legitimate process responsible for Exchange mail transport. Rather than registering a new transport agent, it interferes with handlers belonging to existing agents, allowing messages to be inspected without interrupting delivery.

The malware can identify correspondence using sender and recipient information, subject lines, and attachment criteria, including Word documents and PDFs.

This matters because an organisation could continue sending and receiving emails normally while selected communications are being collected. Routine service-health checks would not necessarily reveal the compromise.

A command channel without conventional infrastructure

Another distinctive feature is how Cereal handles communication with its operators. The CerealNeuron backdoor accepts encrypted instructions through incoming web requests that resemble legitimate Exchange traffic. ESET found no separate external command-and-control infrastructure in the investigated deployments.

The framework also uses CerealRunner to execute task-specific .NET programs in memory, while a separate component, CerealHermit, supports commands delivered through encrypted local files.

This modular design reduces dependence on persistent malware components and familiar network indicators. It does not make the activity invisible, but it complicates detection methods built around suspicious outbound connections or recognisable executable files.

The security implications extend beyond these intrusions

The campaign illustrates a longstanding problem in enterprise security: once attackers gain sufficient control over trusted infrastructure, legitimate application functions can become instruments of surveillance.

For Exchange administrators, detecting such activity requires scrutiny of process integrity, unexpected code execution, unusual web requests, and evidence of unauthorised data collection.

Important questions remain unanswered. ESET's findings do not establish the initial intrusion method or the full extent of information extracted.

Nevertheless, the case demonstrates why protecting email accounts and encrypting communications are only part of securing enterprise messaging. The integrity of the server processing those communications is equally consequential.

AI agents face tougher security tests as Cisco taps Claude Mythos

From Firefox to Linux, GPT-6 Cyber shows how AI is changing vulnerability research

Safari Preview 256 addresses proxy risks, security gaps and performance issues

Identity as the new security control plane: Why AI agents are changing enterprise cybersecurity