CerealBox

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.