Turla Cereal malware copies government email from Exchange servers
Original title: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
ESET found the .NET toolset in Kazakhstan on November 28, 2025, and in Romania on December 23, 2025.
Russia-aligned Turla deployed modular .NET malware that ESET named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. Encrypted commands resemble Outlook Web Access, Autodiscover, and ActiveSync traffic, so the victim server acts as the command infrastructure. CerealBox injects into EdgeTransport.exe and copies messages with .doc, .docx, or .pdf attachments that match hardcoded sender, recipient, subject, or filename lists. In Romania, collection targeted NATO and EU addresses.
Unconfirmed: ESET’s high-confidence Turla attribution rests on a linked component and similarities with older malware; an FSB link is widely assessed, not proven here.
- ESET attributes Cereal to Turla with high confidence.
- Kazakh activity surged on January 15, 2026, after Russia’s Old New Year.
- CerealNeuron listens on paths such as /owa/sdds/ and /autodiscover/proxyservice/.
- Commands are compiled .NET programs that can extract LSA secrets.
- The loader posed as ncobjapi.dll or wbemcomn.dll under System32\wbem.
Impact: Copies selected email and can extract local Windows credentials
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Hunt for ncobjapi.dll and wbemcomn.dll under C:\Windows\System32\wbem.
- 2.Check requests to /owa/sdds/ and /autodiscover/proxyservice/.
- 3.Look for Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache.
- ATT&CK
- T1055 Process InjectionT1114 Email CollectionT1003.004 LSA SecretsT1071.001 Web ProtocolsT1036.005 Match Legitimate Name or Location
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Organizations
- ESETNATOEuropean UnionFSB
- Countries
- KazakhstanRomaniaRussia
From the original article
3 min read at helpnetsecurity.com
Russia-aligned group Turla planted a modular . NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.