Turla's Cereal Malware Turns Microsoft Exchange Servers into Email Exfiltration Hubs
The Russia-aligned Turla group is using a sophisticated .NET malware called Cereal to compromise Microsoft Exchange servers, enabling direct email exfiltration without relying on external command-and-control infrastructure.
The notorious Russian state-sponsored threat group Turla has been observed deploying a novel .NET malware toolkit, dubbed Cereal by researchers at ESET, to compromise Microsoft Exchange servers within two government organizations. This sophisticated toolset allows the attackers to exfiltrate selected emails directly from the mail flow, effectively turning the victims' own email infrastructure into a covert data extraction platform. The malware's design is particularly insidious as it avoids the need for dedicated attacker-controlled servers, instead sending commands disguised as legitimate network traffic.
ESET researchers first discovered Cereal on November 28, 2025, at a government entity in Kazakhstan. Further investigation, following adjustments to their detection capabilities, led to the identification of a second victim in Romania, compromised on December 23, 2025. ESET attributes the Cereal malware to Turla with a high degree of confidence, citing the use of a component previously linked to the group and similarities with older Turla malware families. Turla, also known by the moniker Snake, is widely believed to be an arm of Russia's Federal Security Service (FSB).
The primary backdoor component, CerealNeuron, operates by listening for incoming web requests on specific paths that mimic legitimate Exchange traffic, such as /owa/sdds/ or /autodiscover/proxyservice/. Requests that are properly encrypted and pass several integrity checks are decrypted and executed as commands. Any other traffic is met with a standard-looking Exchange error page, effectively masking the malicious activity. Notably, ESET was unable to identify the IP addresses from which the operators initiated these commands, suggesting a highly stealthy operational method where the compromised victim hosts effectively serve as the command infrastructure.
Cereal employs a modular approach, with each command delivered as a small, compiled .NET program designed for a single, specific task. These tasks can include pulling data from mailboxes, querying Active Directory for user information, extracting sensitive credentials stored locally as LSA secrets, or performing file operations like reading and deleting. The presence of numerous near-identical binaries suggests a framework capable of automatically generating these single-purpose command modules. For redundancy and resilience, a secondary backdoor, CerealHermit, exists, which bypasses network communication entirely by reading encrypted command files directly from disk.
Turla has a history of abusing Exchange transport agents, which are plugins that hook into the mail flow for various functions like spam filtering. However, the CerealBox component takes a more stealthy approach by injecting itself directly into the EdgeTransport.exe process, which handles mail flow. It achieves this by wrapping the handlers of already loaded transport agents in memory, thereby intercepting emails without registering a new, suspicious agent in Exchange's configuration. This method allows for covert manipulation of outgoing and incoming mail.
The CerealBox module is specifically configured to identify and intercept messages containing .doc, .docx, or .pdf attachments that match hardcoded lists of senders, recipients, subject strings, or attachment names. Once identified, these messages are compressed, encrypted, and staged on disk for later retrieval by the operators. ESET highlights that this technique of hooking the transport service from the inside, without registering a new agent, has not been documented in any previous malware family, underscoring Cereal's unique operational methodology.
The initial loader component of Cereal is the only part that is written to disk as a recognizable .NET file. This loader executes native code before the .NET runtime begins its normal execution, making static analysis of the .NET code appear to show a program that does nothing. In one observed attack chain, the loader disguised itself as ncobjapi.dll within the C:\Windows\System32\wbem directory, a location commonly used by the Windows Management Instrumentation service, which would load it automatically. In another instance, it posed as wbemcomn.dll. Attackers also dropped malicious copies into the .NET native image cache, a folder containing precompiled libraries, under names like Microsoft.Exchange.Search.Mdb.ni.dll, ensuring that Exchange would load the malicious file before falling back to the legitimate library.
This new reporting from CyberScoop provides further detail on the targets of Turla's Cereal malware, specifically naming government entities in Kazakhstan and Romania. It also highlights the group's alignment with Russia's Federal Security Service (FSB) and reiterates the malware's stealthy, in-memory execution and use of compromised Exchange servers for command-and-control, making detection exceptionally difficult.
This new report from The Hacker News provides further technical details on the Cereal toolset, including the specific functions of its eight distinct components such as CerealRunner, CerealLoader, and CerealBox. It also highlights the malware's sophisticated use of serialization and its ability to avoid external command-and-control infrastructure by leveraging compromised Exchange servers for this purpose.