- ESET found Turla's new Cereal toolset on Exchange servers at government bodies in Kazakhstan and Romania. It is built to copy selected email from inside the mail pipeline.
- ESET found no attacker-run command server. The victim's own Exchange server takes the commands, so lists of known bad addresses give defenders little to work with.
- Teams should ask who watches what runs inside Exchange and which files sit in key folders, and not only its settings and outbound traffic.
The attacker moved into the mail room
Many defenders look for a stranger. They watch for traffic to a suspicious address, the sign of an attacker-run server. ESET's new research describes a toolset built to avoid that signal. It also keeps almost everything encrypted or in memory, with one loader file on disk.
ESET calls the toolset Cereal. It links Cereal to Turla with high confidence. Turla is a Russia-aligned group, also known as Snake. ESET says it is widely assessed to be part of Russia's Federal Security Service.
The thesis is this: the attackers treated the mail server as a place to work from, not only a place to steal from.
What ESET found
ESET first found the toolset on November 28, 2025. It sat on an Exchange server at a government body in Kazakhstan. ESET then improved its detection and found the toolset at a government body in Romania. ESET says that body was compromised on December 23, 2025.
In Romania, a part called CerealBox was set to pick out mail to or from NATO and European Union institutional addresses. ESET links the Kazakh case to a political backdrop. That link is ESET's own interpretation.
ESET does not say how the attackers got in. The Hacker News also reports that the entry route is unknown.
How it works: no attacker server observed
Most backdoors call home to their operators. That leaves domains, addresses and timing patterns. Defenders can block those. ESET found no attacker-run command server for Cereal.
The main backdoor is CerealNeuron. It never calls out. It sits on the Exchange server and waits for web requests. It answers only on paths that look like normal Exchange traffic. These include ActiveSync, the service that syncs phones with mail.
A request must be properly encrypted and pass several checks. Only then does CerealNeuron decrypt it and treat it as an order. Anything else gets a believable Exchange error page.
ESET says there is no dedicated command infrastructure to discover, block or take down. The victim's own internet-facing Exchange server is the operators' control point. ESET also could not identify the operators' ingress IP addresses.
There is a backup too. CerealHermit has no network features. It reads encrypted command files from disk. In some intrusions, both backdoors ran together.
Each command arrives as its own small .NET program. ESET found many near-identical ones, each built for one task. It concludes that the operators likely have a framework that builds them automatically. ESET researcher Matías Porolli described "a mature, well-engineered platform".
Hiding inside the mail flow
The email collector is CerealBox. Turla has abused Exchange transport agents before. These are a built-in feature that lets software hook into the path mail takes. ESET notes that installed agents leave visible traces in Exchange's settings.
CerealBox leaves no such trace. It is loaded into EdgeTransport.exe, the Exchange process that moves mail. There it wraps agents that are already running in memory. Its own code runs first. Then the original agent carries on, so mail keeps flowing.
ESET says no new agent appears in the settings. It calls the technique novel and not documented before for any malware family.
ESET says the toolset picks out mail with a .doc, .docx or .pdf attachment. The mail must also match built-in lists of senders, recipients, subject words or file names. Chosen messages are compressed, encrypted and saved to disk. Operators later collect and delete them with CerealNeuron commands.
ESET also describes a trick that abuses a speed-up cache. .NET keeps ready-made copies of common libraries so programs start faster. The operators planted rogue copies in that cache. When Exchange asked for a library, it loaded the planted copy first. That copy held no real replacement code. The genuine library then did the actual work, so Exchange looked normal.
The decision this forces
This is about where defenders look. Monitoring that relies only on outbound connections and settings changes would see neither signal in the activity ESET describes. The findings suggest defenders should also look at file locations and at what runs inside processes.
ESET calls the traffic exactly the kind defenders are least likely to block.
This is one research report about two government victims. It does not show how widely Cereal is used. Even so, it shows a design choice that leaders can plan around.
Questions to put to your Exchange team:
Who checks what runs inside Exchange's own processes, and not only what is installed in its settings? Do we check for unexpected DLLs in the Windows WMI folder and the .NET native image cache? Can we spot unusual requests to ActiveSync, Autodiscover and Outlook Web Access paths? Have we compared our systems with the indicators ESET published on GitHub and in its white paper?
ESET says that for Turla, Exchange servers are "durable collection points". If your organization handles sensitive government or alliance mail, give the mail server the same scrutiny as any system that holds secrets.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ESET.
