The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations.
Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the NATO and the EU.
"After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today.
Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
In the campaign analyzed by ESET, the hackers use the Cereal toolset, and specifically a component in the kit named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery in the Microsoft Exchange server.
Turla configured the malware to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files, and match certain sender, recipient, and subject criteria.
Another malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution. CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute.
Commands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files.
“The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands,” ESET says about the disposable programs serving as command carriers.
The CerealRunner components contain encrypted .NET programs and the arguments needed to run them, which execute in the host’s memory and then return their output to CerealNeuron. Eventually, CerealNeuron encrypts the output and sends it back to the attackers.
ESET observed no external command-and-control (C2) infrastructure used in the attack, leaving the compromised Microsoft Exchange server itself to serve as the only control point. The researchers also uncovered a variant of CerealNeuron called CerealHermit, which lacks network capabilities and instead reads commands from encrypted files on the disk.
CerealHermit may serve as a fallback/redundancy system for when Neuron’s web channel becomes unavailable. The researchers note that Cereal’s advanced concealment methods demonstrate Turla’s deep understanding of .NET execution techniques, including abusing the .NET native image cache to run inside legitimate processes.
