Turla's Cereal malware turns victims' Exchange servers into spy hubs
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow.
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow.
ESET researchers found the malware and named it Cereal.
Operators send commands to the victim’s internet-facing Exchange server, dressed up as ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.
ESET found the toolset on November 28, 2025, at a Kazakh government body, and activity in Kazakhstan surged on January 15, 2026, the day after the Old New Year, an informal holiday still observed in Russia.
CerealNeuron, the main backdoor, sits on the Exchange server and listens for incoming web requests on paths that look like normal Exchange traffic, such as /owa/sdds/ and /autodiscover/proxyservice/.
On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox, and somewhere in a national government office, an official sends an email to a colleague at a transnational military alliance.
After tuning its detections, the company spotted the Romanian victim, compromised on December 23, 2025; eSET could not identify the IP addresses the operators connected from.
It points to a component publicly linked to Turla that was used alongside Cereal, and to similarities with older Turla malware, and a request that is properly encrypted and passes several integrity checks gets decrypted and run as a command.
To anyone watching the network, it looks like people checking their email.
The message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious.
What happened
Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow.
ESET researchers found the malware and named it Cereal.
Operators send commands to the victim’s internet-facing Exchange server, dressed up as ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.
What changed
ESET found the toolset on November 28, 2025, at a Kazakh government body, and activity in Kazakhstan surged on January 15, 2026, the day after the Old New Year, an informal holiday still observed in Russia.
CerealNeuron, the main backdoor, sits on the Exchange server and listens for incoming web requests on paths that look like normal Exchange traffic, such as /owa/sdds/ and /autodiscover/proxyservice/.
Who is affected
On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox, and somewhere in a national government office, an official sends an email to a colleague at a transnational military alliance.
Why it matters
After tuning its detections, the company spotted the Romanian victim, compromised on December 23, 2025; eSET could not identify the IP addresses the operators connected from.
Technical details
It points to a component publicly linked to Turla that was used alongside Cereal, and to similarities with older Turla malware, and a request that is properly encrypted and passes several integrity checks gets decrypted and run as a command.
Response
To anyone watching the network, it looks like people checking their email.
What security teams should do
The message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.