ESET Uncovers Turla-Linked Cereal Toolset Targeting Exchange Servers
Summary
ESET researchers describe Cereal, a modular .NET toolset they attribute with high confidence to Turla, found on government Exchange servers in Kazakhstan and Romania. It uses compromised servers for command-and-control and covert email collection.
Key points
- ESET researchers found the toolset at government organizations in Kazakhstan and Romania and attribute it with high confidence to Russia-aligned Turla.
- CerealNeuron turns a compromised Exchange server into a passive command channel, avoiding dedicated external command-and-control infrastructure.
- CerealBox is injected into Exchange’s mail transport process to filter, encrypt, and stage selected emails for later collection.
- The modular .NET components deliver and execute commands in memory, including mailbox access, Active Directory queries, WMI queries, and credential extraction.
- CerealLoader uses techniques including unmanaged entry points, Vtable Fixups, and abuse of the .NET native image cache to conceal execution.
- In Romania, CerealBox was configured to collect messages involving NATO and EU institutional addresses.
Article Details
- Attack Vectors
- Turla-attributed Cereal components were deployed on compromised governmental Microsoft Exchange servers in Kazakhstan and Romania.
- CerealNeuron waits for incoming HTTPS requests on Exchange-like paths and executes commands from requests that pass integrity checks; the article reports no external C2 infrastructure.
- CerealLoader was placed under names of legitimate Windows DLLs for automatic loading by the Windows Management Instrumentation service, and malicious files were also placed in the .NET native image cache.
- CerealBox was injected into Exchange's EdgeTransport.exe process and hooked existing transport-agent handlers in memory to collect selected email messages.
- Operators delivered commands as separate encrypted .NET assemblies, which Cereal components unpacked and executed in memory.
- Reported commands included querying Active Directory and WMI, extracting LSA Secrets, retrieving email, and listing, reading, and deleting files.
- Defensive Notes
- The article reports that Cereal may leave no dedicated external C2 infrastructure; review incoming Exchange web requests and investigate suspicious requests to Exchange-like paths.
- Inspect Exchange and Windows processes for unexpected in-memory code, DLLs impersonating legitimate Windows components, and suspicious files in the .NET native image cache.
- Review Exchange transport behavior for handlers modified in memory and for collection or staging of selected email messages.
MITRE ATT&CK
T1003.004 · LSA SecretsOne reported CerealRunner command extracts LSA Secrets stored locally on Windows.T1018 · Remote System DiscoveryCerealRunner commands query Active Directory for computers.T1027 · Obfuscated Files or InformationThe toolset keeps payloads and commands in encrypted containers and decrypts them at runtime.T1041 · Exfiltration Over C2 ChannelOperators use CerealNeuron commands to retrieve staged email dumps, with command output returned through the same encrypted pipeline.T1049 · System Network Connections DiscoveryReported WMI queries enumerate active TCP connections.T1055 · Process InjectionCerealBox is injected into Exchange's EdgeTransport.exe process, where it hooks existing transport-agent handlers in memory.T1057 · Process DiscoveryReported WMI queries list running processes.T1069.002 · Domain GroupsCerealRunner commands query Active Directory for groups.T1070.004 · File DeletionReported commands list, read, and delete files, including staged email dumps.T1071.001 · Web ProtocolsCerealNeuron receives operator commands through incoming HTTPS requests to paths that resemble ordinary Exchange traffic.T1087.002 · Domain AccountCerealRunner commands query Active Directory for user accounts.T1105 · Ingress Tool TransferOperators send commands as separate executable .NET assemblies through CerealNeuron requests.T1114.001 · Local Email CollectionCerealBox collects selected messages by hooking Exchange's email transport pipeline; other commands retrieve mailboxes or specific messages.T1574.002 · DLL Side-LoadingCerealLoader was placed under legitimate DLL names, including ncobjapi.dll and wbemcomn.dll, for automatic loading by the WMI service.
Threat Actors
Malware
CerealBoxThe Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses.CerealHermitCerealHermit, a variant of CerealNeuron with no network functionalities.CerealIronCerealIron, an injector that allows operators to load and run .NET assemblies from non .NET processes.CerealLoaderCerealLoader, which loads and runs a .NET assembly from an encrypted file on disk.CerealMothCerealMoth, a simple component that receives an assembly and a method name as arguments, loads the assembly, and runs the specified method.CerealNeuronCerealNeuron, a passive backdoor with no built-in commands but capable of executing assemblies contained in CerealRunner binaries, received in network requests; we named it in reference to Neuron, a malware familyCerealRunnerCerealRunner, which contains other encrypted binaries that are loaded and executed.CerealSprinterCerealSprinter, which is similar to CerealRunner, but is used only to load and run other components.
Vendors
Products
.NETseparate suspicious components soon revealed a previously undocumented toolset: a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map theMicrosoft Active DirectoryQuerying Active Directory for computers, users, groups, and DNS records.Microsoft ExchangeThe message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious.Microsoft Windowsencrypted payloads on disk, .NET assemblies embedded inside other .NET assemblies, legitimate Windows processes loading suspicious DLLs, and Exchange services executing code that did not belong there.
Countries
KazakhstanOn November 28th, 2025, we found the toolset that installs such code on an Exchange server of a governmental organization in Kazakhstan.RomaniaAfter fine-tuning our detections, we found the same toolset at a governmental organization in Romania – compromised on December 23rd, 2025 – where it was configured to identify emails sent to, or received from, TheRussiaWe attribute Cereal, with high confidence, to the Russia-aligned APT group Turla, based on the concurrent use of another component publicly linked to Turla and conceptual similarities to older Turla malware.
Industries
DefenseIts usual targets are governments, diplomatic missions, and defense organizations, primarily across Europe, Central Asia, and the Middle East.DiplomaticIts usual targets are governments, diplomatic missions, and defense organizations, primarily across Europe, Central Asia, and the Middle East.GovernmentSomewhere in a national government office, an official sends an email to a colleague at a transnational military alliance.