Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal.

The toolset doesn’t need an attacker-owned server. Operators send commands to the victim’s internet-facing Exchange server, dressed up as ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic. To anyone watching the network, it looks like people checking their email. In Romania, the email collection module was set to pick out messages sent to or received from NATO and EU addresses.

“On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox. Somewhere in a national government office, an official sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious. But before the email leaves the building, a piece of code quietly examines it, decides that it is interesting, and sets aside a copy to be forwarded to prying eyes, while the original email continues on its way,” explains ESET researcher Matías Porolli .

Two governments, one month apart

ESET found the toolset on November 28, 2025, at a Kazakh government body. After tuning its detections, the company spotted the Romanian victim, compromised on December 23, 2025. ESET attributes Cereal to Turla with high confidence. It points to a component publicly linked to Turla that was used alongside Cereal, and to similarities with older Turla malware. Turla, also known as Snake, is widely assessed to be part of Russia’s FSB.

Activity in Kazakhstan surged on January 15, 2026, the day after the Old New Year, an informal holiday still observed in Russia. The operators, it seems, took the holiday off.

Components used in the observed attacks (Source: ESET)

The backdoor waits for a knock

CerealNeuron, the main backdoor, sits on the Exchange server and listens for incoming web requests on paths that look like normal Exchange traffic, such as /owa/sdds/ and /autodiscover/proxyservice/. A request that is properly encrypted and passes several integrity checks gets decrypted and run as a command. Anything else gets a legitimate-looking Exchange error page. ESET could not identify the IP addresses the operators connected from. In effect, the victim hosts the attacker’s command server.

Each command arrives as a small, compiled .NET program built for one job: pulling mailboxes, querying Active Directory, extracting LSA secrets (credentials Windows stores locally), or reading and deleting files. The number of near-identical binaries points to a framework that builds commands automatically. A second backdoor, CerealHermit, skips the network entirely and reads encrypted command files from disk, giving the operators a fallback.

Mail gets copied from inside Exchange

Turla has abused Exchange transport agents before. These are plugins that hook into mail flow for jobs like spam filtering, and a registered agent shows up in Exchange’s configuration. CerealBox avoids that by injecting itself into EdgeTransport.exe, the process that moves mail, and wrapping the handlers of transport agents already loaded in memory. Mail keeps flowing, and no new agent appears.

CerealBox keeps messages that carry a .doc, .docx, or .pdf attachment and match hardcoded lists of senders, recipients, subject strings, or attachment names. It compresses, encrypts, and stages them on disk for operators to collect later. ESET says hooking the transport service from the inside has not been documented for any malware family before.

Cereal’s loader is the only component written to disk as a recognizable .NET file. It runs native code before the .NET runtime starts its normal instructions, so an analyst reading its .NET code sees a program that appears to do nothing. In one chain it posed as ncobjapi.dll in C:\Windows\System32\wbem, where the Windows Management Instrumentation service loaded it automatically. In another it posed as wbemcomn.dll. Operators also dropped copies into the .NET native image cache, a folder of precompiled libraries, under names such as Microsoft.Exchange. .Mdb.ni.dll. Exchange loaded the malicious file first, then fell back to the real library.