By news editor
A Russia-aligned espionage group has been running a previously undocumented toolset inside the Microsoft Exchange servers of two national governments, according to ESET, and the design choice that matters most for defenders is what the toolset lacks: any server of its own.
ESET Research calls the toolset Cereal and attributes it to Turla with high confidence, citing the concurrent use of another component publicly linked to the group and conceptual similarities to older Turla malware. ESET says it found the toolset on November 28, 2025 on the Exchange server of a governmental organization in Kazakhstan, and a month later at a governmental organization in Romania that had been compromised on December 23, 2025. In the Romanian case, the email collection module was configured to identify messages sent to or received from NATO and European Union addresses.
The security company’s own summary of the design is blunt. “One of the most interesting aspects of this toolset is what we did not find: external command and control (C&C) infrastructure,” ESET writes. Instead, a passive backdoor the researchers call CerealNeuron runs on the compromised Exchange server and waits for incoming web requests on paths that resemble ordinary Outlook Web Access, Autodiscover and ActiveSync traffic. Requests that pass its encryption and integrity checks are treated as commands; anything else is redirected to an Exchange-style error page.
For companies that still run Exchange on their own hardware, the consequence is that the usual network defenses have nothing to block. ESET says there is no dedicated attacker infrastructure to discover or take down, that malicious traffic sits alongside legitimate Exchange web services, and that its researchers were unable to identify the IP addresses the operators connected from.
The mail theft itself is handled by a component ESET calls CerealBox, which is injected into EdgeTransport.exe, the Exchange process that handles message flow. Rather than registering a transport agent, which would leave a trace in Exchange’s configuration, CerealBox wraps the handlers of agents already loaded in memory, runs its own logic first and hands control back, so mail keeps moving normally. ESET’s assessment: “Injecting into the Exchange transport service and hooking mail flow from within is a novel technique, not previously documented for any malware family.”
A message qualifies for collection if it carries a .doc, .docx or .pdf attachment and matches hardcoded lists of sender addresses, recipient addresses, subject substrings or attachment names, according to the report. Matching messages are compressed, encrypted and staged on disk until operators retrieve and delete them.
Commands arrive as separate compiled .NET programs rather than as a fixed menu inside one backdoor. ESET lists tasks that include retrieving mailboxes through Exchange Web Services, querying Active Directory for computers, users, groups and DNS records, and extracting LSA Secrets, the credentials Windows stores locally. “The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands,” the report says. In all, ESET describes eight components, from the on-disk loader to the email harvester.
What ESET does not say is how the operators got onto the servers in the first place. The Hacker News, which received the report ahead of publication, reports that the initial access vector is unknown, while noting that Turla is known to use spear-phishing, watering-hole and ISP-level adversary-in-the-middle attacks. Neither ESET nor The Hacker News puts a figure on the cost of the two intrusions or names the agencies involved, and no customer or financial impact is disclosed.
Turla, also tracked as Snake, has been active since at least 2004 and is widely assessed to be part of Russia’s Federal Security Service, ESET says. Based on the company’s telemetry, around 70% of the countries Turla has targeted since 2022 have been former Soviet republics or European countries once closely aligned with the Soviet Union, which fits the two confirmed victims here.
ESET has published indicators of compromise in a GitHub repository and a white paper. The next thing to watch is whether Microsoft, the national cyber authorities in Romania and Kazakhstan, or other security vendors corroborate the findings or report further victims, and whether the transport-service injection technique shows up in intrusions beyond these two government networks.
Leave a Reply