A Russian state-sponsored cyber-espionage group known as Turla has deployed a previously undocumented modular .NET toolset dubbed Cereal to harvest emails from on-premises Microsoft Exchange servers. According to reporting from BleepingComputer, researchers at cybersecurity firm ESET discovered the malware operating inside government bodies in Kazakhstan and Romania in late 2025.

Turla, also tracked as Snake, Secret Blizzard, and Waterbug, is linked to Russia's Federal Security Service (FSB) and has operated for over two decades. The newly identified Cereal toolset turns compromised Exchange servers into long-term collection hubs while eschewing external command-and-control servers, enabling the threat actor to operate undetected within victim environments.

Stealth Operations and Memory Injection

The Cereal toolset relies heavily on object serialization, which inspired its name. ESET's investigation, detailed by The Hacker News, outlined eight interconnected components engineered to execute commands directly in memory and minimize its footprint on disk.

Central to its email-interception capabilities is a component named CerealBox. Rather than registering a new transport agent—a mechanism that leaves traces in Exchange's administrative configurations—CerealBox injects into the core Exchange transport process, EdgeTransport.exe. From there, it wraps existing in-memory handlers of previously loaded transport agents.

By manipulating the email transport pipeline internally, CerealBox evaluates emails as they transit the server without disrupting delivery or generating administrative notifications. The module monitors for messages containing .DOC, .DOCX, and .PDF attachments that match hardcoded lists of senders, recipients, and subject lines. In the Romanian compromise, the module specifically targeted correspondence involving North Atlantic Treaty Organization (NATO) and European Union institutions.

Turning the Exchange Server into a C2 Hub

Instead of communicating with attacker-controlled infrastructure, Cereal relies on the compromised server itself to act as the primary operational point. As reported by Help Net Security, the primary backdoor, CerealNeuron, operates passively by listening for encrypted inbound web requests directed at paths resembling legitimate services, such as /owa/sdds/ and /autodiscover/proxyservice/.

When an incoming request passes decryption and integrity checks, CerealNeuron executes an embedded wrapper known as CerealRunner. If an unauthorized request arrives, the server returns standard Exchange error pages, blending operator interactions with legitimate Outlook Web Access and Autodiscover traffic.

The operators deliver single-purpose compiled .NET binaries designed to run specific instructions, including Active Directory queries, Windows Management Instrumentation (WMI) sweeps, mailbox extraction, local credential harvesting via LSA Secrets, and file deletion. ESET identified a separate offline fallback component, CerealHermit, which bypasses network listeners entirely and reads encrypted task files directly from local storage.

Targeting Government Organizations

ESET first observed the Cereal malware on November 28, 2025, at a government organization in Kazakhstan. Following detection adjustments, researchers discovered a second compromise on December 23, 2025, inside a Romanian government body. Activity in Kazakhstan surged on January 15, 2026, coinciding with the end of the traditional Russian Old New Year.

To maintain stealth, the operators exploited legitimate Windows features to trigger persistence. Attackers placed masqueraded dynamic-link libraries, such as ncobjapi.dll and wbemcomn.dll, into administrative paths to hijack WMI execution. In other instances, operators planted malicious files like Microsoft.Exchange.Search.Mdb.ni.dll inside the .NET native image cache, causing Exchange to load malicious code prior to accessing genuine libraries.

What Defenders Should Do

Organizations running on-premises Microsoft Exchange servers should inspect server filesystems and transport processes for indicators of Cereal tradecraft:

  • Inspect EdgeTransport.exe integrity: Verify memory spaces and process threads associated with EdgeTransport.exe for unauthorized injected .NET modules and hooked handlers.
  • Audit system directories and native image caches: Search for unexpected DLL files in C:\Windows\System32\wbem, specifically looking for unverified instances of ncobjapi.dll or wbemcomn.dll, and examine native image cache directories for unauthorized .ni.dll files.
  • Monitor Exchange web paths: Review web server access logs for anomalous requests to atypical subpaths under /owa/ and /autodiscover/ that return non-standard payloads or exhibit abnormal request sizes.
  • Query Active Directory and credential access logs: Audit servers for unexpected WMI queries, suspicious Active Directory enumeration commands, and attempts to extract LSA Secrets.