cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Turla Uses Cereal Malware to Spy on Government Exchange Servers

· Original article ↗

Summary

ESET documented Turla's Cereal toolset on government Exchange servers in Kazakhstan and Romania. Its modular .NET components can inspect selected emails, run commands in memory, and return results through the compromised server.

Key points

  • ESET reported finding Cereal at government organizations in Kazakhstan and Romania; researchers said the Romanian organization was compromised on December 23, 2025.
  • CerealBox injects into Exchange's EdgeTransport.exe process and hijacks existing transport-agent handlers without registering a new agent or interrupting email delivery.
  • The malware selectively collects messages matching sender, recipient, and subject criteria, including messages with DOC, DOCX, or PDF attachments.
  • CerealNeuron receives encrypted web requests and runs commands through CerealRunner, which carries encrypted .NET programs executed in memory.
  • Reported commands include retrieving Exchange emails, querying Active Directory, extracting locally stored credentials, reading files, and deleting files.
  • ESET found no external C2 infrastructure in the observed attack; the compromised Exchange server served as the control point. CerealHermit can read commands from encrypted files as a possible fallback.

Article Details

Attack Vectors
  • Turla used CerealBox to inject into the Exchange EdgeTransport.exe process and hijack existing transport-agent handlers.
  • CerealNeuron awaited encrypted web requests on paths resembling legitimate Exchange services, then decrypted commands and executed CerealRunner.
  • Commands could retrieve Exchange email, query Active Directory for users and groups, extract locally stored credentials, read files, or delete files.
  • CerealHermit, a variant without network capabilities, read commands from encrypted files on disk and may have served as a fallback.

MITRE ATT&CK

T1005 · Data from Local SystemCommands could read files on the compromised server.T1055 · Process InjectionCerealBox injected into the Exchange EdgeTransport.exe process.T1069.002 · Domain GroupsCommands could query Active Directory for groups.T1071.001 · Web ProtocolsCerealNeuron received commands through encrypted web requests on paths resembling legitimate Exchange services.T1087.002 · Domain AccountCommands could query Active Directory for users.T1114.002 · Remote Email CollectionCereal could retrieve email from Exchange and selectively collect messages matching attachment, sender, recipient, and subject criteria.T1573 · Encrypted ChannelCerealNeuron decrypted incoming requests and encrypted execution output before sending it back to the attackers.

Threat Actors

TurlaESET attributed the campaign using the Cereal toolset to Turla.

Malware

CerealTurla hackers use new Cereal malware to spy on govt Exchange serversCerealBoxanalyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers.CerealHermitThe researchers also uncovered a variant of CerealNeuron called CerealHermit, which lacks network capabilities and instead reads commands from encrypted files on the disk.CerealNeuronAnother malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution.CerealRunnerCerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute.

Vendors

MicrosoftThe Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Products

Microsoft Active DirectoryCommands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files.Microsoft ExchangeThe Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Countries

KazakhstanResearchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan.RomaniaA month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the EuropeanRussiaTurla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).

Industries

GovernmentThe Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.

Related Articles