Turla’s Cereal toolset found on government Exchange servers
Original title: Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room
ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.
ESET reported a previously undocumented toolset, Cereal, on Microsoft Exchange at a Kazakhstan government body on 28 November 2025 and a Romanian government body compromised on 23 December. ESET attributes it with high confidence to Turla. CerealNeuron waits for commands on paths resembling Outlook Web Access, Autodiscover, and ActiveSync, so there is no external server to block. CerealBox injects into EdgeTransport.exe and stages selected messages without registering a transport agent.
Unconfirmed: ESET attributes the activity to Turla with high confidence and could not identify operator ingress addresses.
- Only the first loader is stored on disk; other .NET modules unpack in memory.
- CerealHermit reads encrypted command files from disk and has no network functions.
- CerealRunner carries compiled tasks for mail, Active Directory, WMI, credentials, and files.
- Romania’s deployment watched email to or from NATO and the European Union.
- Selected .doc, .docx, and .pdf messages are compressed, encrypted, and staged.
Impact: Stealthy access to government email, directories, and credentials
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Check the Windows management folder for unusual DLLs such as ncobjapi.dll.
- 2.Look for unexpected files in the .NET native image cache.
- 3.Review requests to Outlook Web Access, Autodiscover, and ActiveSync paths.
From the original article
4 min read at securityaffairs.com
ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania. ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.