NATO

Turla APT Deploys Modular Cereal Malware Framework to Harvest Emails from Microsoft Exchange Servers

The Russia-aligned threat actor Turla has been observed deploying a previously undocumented modular toolset called Cereal against government Exchange servers in Kazakhstan and Romania. The framework enables long-term stealthy email collection by abusing compromised Microsoft Exchange instances as internal C2 hubs without any external infrastructure. ESET researchers detailed how Cereal components run in memory, inject into EdgeTransport.exe, and filter messages containing DOC, DOCX or PDF attachments based on hardcoded sender, recipient, subject and attachment rules. In the Romanian incident the malware was configured to target NATO and European Union-related addresses. Commands are delivered as compiled .NET assemblies that CerealRunner executes in memory, supporting Active Directory enumeration, WMI queries, LSA Secrets extraction and file operations. The absence of disk artifacts and the use of serialization throughout the eight-component framework highlight Turla’s deep knowledge of Exchange internals.

Turla APT Group Deploys Cereal Toolset to Intercept Emails on Microsoft Exchange Servers

The Russian state-backed threat group Turla has been using a new malicious toolset called Cereal to intercept emails on Microsoft Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. In the campaign, the hackers use the Cereal toolset, and specifically a component named CerealBox, to inject into Exchange’s EdgeTransport.exe process and hijack existing transport agents’ handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery. Another component, CerealNeuron, awaits incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution via CerealRunner. ESET observed no external C2 infrastructure, leaving the compromised Exchange server itself to serve as the only control point, and uncovered a variant called CerealHermit as a fallback mechanism.