Summary
ESET researchers have detailed a previously unknown toolset, dubbed Cereal, used by the Russian state-linked group Turla (also tracked as Snake, Secret Blizzard, Venomous Bear, and Waterbug) to intercept email on Microsoft Exchange servers at government organizations. ESET links Turla to Russia's FSB, and the group has been active since at least 2004.
Victims and Timeline
- ESET first found the toolset in late 2025 on a government email server in Kazakhstan.
- About a month later, it found the same toolset at a government agency in Romania, compromised on December 23, 2025. There, the malware was configured to collect mail exchanged with NATO and EU representatives.
- ESET could not determine how the attackers gained initial access or how much data they obtained. In Kazakhstan, researchers could not confirm whether Russian exiles or Kremlin critics were the target.
ESET notes that roughly 70% of the countries Turla has targeted since 2022 are former Soviet republics or European countries with historical Soviet ties.
How the Toolset Works
| Component | Role |
|---|---|
| CerealBox | Injects into the Exchange EdgeTransport.exe process and hijacks existing transport agent handlers to inspect mail in memory, without registering a new transport agent or disrupting delivery |
| CerealNeuron | Waits for encrypted web requests on paths resembling legitimate Exchange services, decrypts them, and executes commands |
| CerealRunner | Wrapper that carries encrypted .NET programs for CerealNeuron to run |
| CerealHermit | Variant with no network capability that reads commands from encrypted files on disk, possibly a fallback channel |
Key behaviors:
- Selective collection — CerealBox targets messages with .DOC, .DOCX, or .PDF attachments that match sender, recipient, or subject criteria.
- Command capabilities — retrieving emails, querying Active Directory (users, groups, DNS records), extracting stored credentials, and reading or deleting files, with encrypted output.
- No external C2 — ESET observed no outside command-and-control servers; the compromised Exchange server is the only control point, which makes the traffic harder to detect or block.
- Small footprint — the toolset abuses the .NET native image cache to run inside legitimate processes. The many near-identical, task-specific binaries suggest an internal framework that automates compiling and packaging commands.
Defensive Guidance
The coverage does not include vendor mitigation guidance beyond indicators of compromise, which ESET published in its eset/malware-ioc GitHub repository (Turla directory). Reasonable steps for Exchange administrators include:
- Hunt using ESET's published IOCs on all on-premises Exchange servers.
- Review
EdgeTransport.exefor unexpected loaded modules and review .NET native image cache entries for unfamiliar assemblies. - Inspect IIS and Exchange logs for unusual request paths to Exchange-lookalike endpoints.
- Keep Exchange patched, restrict administrative access, and where feasible, migrate away from internet-exposed on-premises Exchange.
Sources
- BleepingComputer: Turla hackers use new Cereal malware to spy on govt Exchange servers
- The Record: Russian hackers compromised government email servers to steal NATO, EU correspondence
- ESET research, "Exchange for breakfast: Turla's Cereal tricks are not for kids"