Turla’s Cereal toolkit turns Exchange servers into surveillance platforms
Original title: Russian-Linked Turla Hackers Abuse Microsoft Exchange Infrastructure to Target Sensitive Communications
ESET found the .NET toolset at government organizations in Kazakhstan and Romania and attributes it to Turla with high confidence.
ESET said Russian-linked Turla deployed Cereal, a previously undocumented .NET toolkit, on Microsoft Exchange servers. CerealNeuron accepts commands over HTTPS paths resembling Exchange web services, while CerealBox, injected into EdgeTransport.exe, collects selected messages with document or PDF attachments. ESET detected it at a Kazakh government organization on November 28, 2025, and later at a Romanian government organization compromised from December 23, 2025. Initial access remains undetermined.
Unconfirmed: Initial access is undetermined; exploitation of an internet-facing Exchange vulnerability is only a possible vector.
- Romanian rules targeted NATO and EU addresses, including nato.int and europa.eu.
- ESET found no dedicated external command server and could not identify operator IPs.
- In-memory payloads support Exchange Web Services, Active Directory, WMI, and LSA Secrets access.
- CerealBox wraps existing transport-agent handlers rather than registering a new agent.
- ESET links Cereal conceptually to Turla’s earlier LightNeuron Exchange backdoor.
Impact: Selected government email collected from compromised Exchange servers
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Inspect Exchange process memory and unexpected module loads.
- 2.Review Exchange web requests and encrypted local staging files.
- ATT&CK
- T1055 Process InjectionT1114 Email CollectionT1003.004 LSA SecretsT1047 Windows Management InstrumentationT1574.001 DLL Search Order Hijacking
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Malware
- CerealCerealNeuronCerealBox
- Organizations
- ESET
- Countries
- KazakhstanRomaniaRussia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | europa.eu | opean Union institutional addresses, including nato.int and europa.eu. Microsoft Exchange Abuse The victim’s own server therefore |
From the original article
3 min read at gbhackers.com
Russian-linked espionage group Turla has deployed a previously undocumented . NET malware toolkit that turns compromised Microsoft Exchange servers into surveillance platforms and command infrastructure. Named Cereal, the modular toolset intercepts selected emails while allowing legitimate messages to continue through the transport pipeline, concealing intelligence collection inside routine government communications.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.