ESET has exposed Cereal, a modular toolset that Russia’s Turla group installed inside government Exchange servers to quietly copy selected email, and in one case configured it to target traffic involving NATO and EU addresses. ESET found no attacker-owned servers behind it, which makes it a hard thing to spot and a useful reminder of why on-premises Exchange deserves far more scrutiny than it usually gets.
What happened
On 10 November 2026, ESET Research published its analysis of a previously undocumented espionage toolkit it has named Cereal, a nod to the heavy use of serialisation throughout the code. The Slovak firm attributes the toolkit with high confidence to Turla, the long-running Russian group also tracked as Snake and widely assessed by Western governments to sit within the Federal Security Service (FSB).
ESET first found the components on 28 November 2025 on a Microsoft Exchange server belonging to a government body in Kazakhstan. Once its detections were tuned, it turned up a second victim: a Romanian government organisation compromised on 23 December 2025. There, the mail harvester was configured to target correspondence involving NATO and EU institutional addresses.
The initial access route is unknown. Turla has historically used spear-phishing, watering holes and ISP-level interception, but nothing ties those methods to these two intrusions.
The technical picture
Cereal is not a single implant. ESET describes eight cooperating .NET components, among them a loader, a runner that carries encrypted task modules, a passive backdoor called CerealNeuron, an offline variant called CerealHermit, an injector, and the mail harvester CerealBox. Only the loader sits on disk as a recognisable .NET file; everything else lives inside encrypted containers and is unpacked and executed in memory.
The standout design choice is the absence of external command and control. CerealNeuron does not beacon out. It waits on the compromised Exchange server for inbound web requests addressed to paths that resemble normal Outlook on the web, Autodiscover and ActiveSync traffic. Requests that pass its encryption and integrity checks are treated as commands; anything else is bounced to a plausible Exchange error page. In the words of ESET researcher Matías Porolli, the victim’s mail server ends up “co-opted to act as the C&C infrastructure”. That leaves defenders with no domains, IP addresses or hosting providers to block, and ESET says it could not identify where operator traffic originated.
Commands arrive as small, purpose-built .NET programs rather than as instructions to a large backdoor. ESET recovered many near-identical runner binaries, each compiled for one job such as pulling mailboxes through Exchange Web Services, querying Active Directory and DNS, running WMI queries, extracting LSA Secrets or managing staged files, suggesting an automated internal build pipeline.
CerealBox is the novel part. Turla has abused Exchange transport agents before, but registered agents show up in configuration. This time the module is injected into EdgeTransport.exe, which handles Exchange mail flow, and wraps the handlers of transport agents that are already loaded. Mail flows normally and no new agent appears. Messages carrying .doc, .docx or .pdf attachments that match hard-coded sender, recipient, subject or filename lists are compressed, encrypted and staged on disk for later collection. ESET says this in-process hooking of the mail pipeline has not previously been documented for any malware family.
The loader also abuses little-known .NET features and the native image cache, and was planted as DLLs that legitimate processes load automatically.
Why it matters for UK organisations
No UK victim has been reported, and ESET names only the Kazakh and Romanian bodies. The UK relevance is my own assessment, but I think it is a reasonable one. Turla’s targeting has long centred on governments, diplomatic missions and defence organisations across Europe, and the Romanian configuration shows an explicit interest in correspondence with NATO and the EU. UK departments, arm’s-length bodies, defence primes and their suppliers exchange exactly that kind of traffic every day.
There is also a direct UK lineage. ESET named CerealNeuron after Neuron, a Turla implant that the NCSC itself documented and attributed in 2017, because the two behave in similar ways. In other words, this is an evolution of a technique British defenders have seen before, now with the noisy parts removed.
Finally, on-premises and hybrid Exchange has not disappeared from UK estates. Many organisations keep a server for hybrid management or mail relay, and those boxes are often patched late and watched lightly. Cereal shows that a forgotten server can act as an intelligence collection point and an internal command hub at the same time.
Expert view
When we test Exchange environments, the server is usually treated as plumbing: it is internet-facing, it runs with significant privileges, and yet it rarely gets the endpoint telemetry, memory inspection or change control given to domain controllers. Cereal exploits that blind spot almost perfectly.
The lesson for red and blue teams alike is that network-centric detection is not enough here. Detection has to come from the host: unexpected modules inside Exchange processes, odd DLLs in system folders, tampering with the .NET native image cache, and encrypted blobs appearing in places mail servers do not normally write. In my experience, few organisations baseline any of that on their mail servers.
Building a reliable hook inside the Exchange transport pipeline takes deep product knowledge, which signals that Turla sees Exchange as a long-term collection platform, not a one-off foothold.
What to do now
- Inventory every Exchange server. Include hybrid management boxes and relay servers. Retire any you do not need; that is the cheapest control available.
- Patch and harden. Keep Exchange on supported cumulative updates and apply security updates promptly, in line with the Cyber Essentials security update management control. Remove legacy protocols and published paths you do not use.
- Put the server under proper endpoint monitoring. Run EDR on Exchange hosts with memory scanning enabled, and alert on unsigned or unexpected modules loaded into Exchange and WMI processes.
- Hunt using ESET’s indicators. ESET has published IoCs in its GitHub repository and white paper. Check system folders and the .NET native image cache for files that do not belong.
- Review transport agents and mail flow. Compare loaded agents with the expected list and baseline normal behaviour, even though CerealBox avoids adding new ones.
- Watch inbound requests, not just outbound ones. Log and review web requests to Exchange virtual directories for unusual payload sizes, sources and timing.
- Limit privilege and protect secrets. Restrict administrative access to Exchange servers and apply Cyber Essentials user access control principles. Treat LSA Secrets on those hosts as exposed if compromise is suspected.
- Consider moving sensitive correspondence. Where possible, migrate to supported cloud mail with strong logging, and sign up to the NCSC’s Early Warning service.
Bottom line
Cereal is a polished piece of state tradecraft that turns the victim’s mail server into both the listening post and the control channel. There is no evidence that UK bodies have been hit, but any organisation that corresponds with NATO or EU institutions and still runs Exchange on its own premises should assume it is the kind of target Turla wants, and should start looking at what is running inside its mail servers.
Sources
- ESET WeLiveSecurity: Exchange for breakfast: Turla’s Cereal tricks are not for kids
- The Hacker News: Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
- Help Net Security: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
- CyberScoop: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
