Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan.
A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU).
Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
In the campaign analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers.
The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery in the Exchange server.
Commands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files.
ESET observed no external command-and-control (C2) infrastructure used in the attack, leaving the compromised Exchange server itself to serve as the only control point.
CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute.
The CerealRunner components contain encrypted .NET programs and the arguments needed to run them, which execute in the host’s memory and then return their output to CerealNeuron.
Turla configured the malware to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files, and match certain sender, recipient, and subject criteria.
Another malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution.
ESET says the Cereal toolset was designed for long-term, stealthy cyberespionage, featuring a small disk footprint and relying on infrastructure that is less likely to be detected and blocked.
Microsoft: October Windows Server updates break Exchange sign-in, mail flow Russian cloud firm Beget rebuilds from scratch after data wiper attack Hackers use n-day exploits in zero-click attacks on iOS, Android devices
What happened
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan.
A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU).
What changed
Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
In the campaign analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers.
The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery in the Exchange server.
Who is affected
Commands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files.
ESET observed no external command-and-control (C2) infrastructure used in the attack, leaving the compromised Exchange server itself to serve as the only control point.
Why it matters
CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute.
The CerealRunner components contain encrypted .NET programs and the arguments needed to run them, which execute in the host’s memory and then return their output to CerealNeuron.
Technical details
Turla configured the malware to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files, and match certain sender, recipient, and subject criteria.
Another malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution.
Response
ESET says the Cereal toolset was designed for long-term, stealthy cyberespionage, featuring a small disk footprint and relying on infrastructure that is less likely to be detected and blocked.
Microsoft: October Windows Server updates break Exchange sign-in, mail flow Russian cloud firm Beget rebuilds from scratch after data wiper attack Hackers use n-day exploits in zero-click attacks on iOS, Android devices
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.