Turla Uses Cereal Malware to Spy on Government Exchange Servers

The Russian state-backed cyber-espionage group Turla has used a new malware toolset called Cereal to collect emails from Microsoft Exchange servers at government organizations, according to cybersecurity company ESET.

ESET said it first found the modular .NET malware at a government body in Kazakhstan in late 2025. A month later, researchers found the toolset at a Romanian government agency that had been compromised on December 23, 2025. There, it selectively collected correspondence with representatives of NATO and the European Union (EU).

A component called CerealBox injects into Exchange’s EdgeTransport.exe process and takes over handlers used by existing transport agents. It can inspect email content and run commands in memory without registering a new transport agent or interrupting normal mail delivery. Turla configured it to collect messages matching sender, recipient, and subject criteria, including messages with .DOC, .DOCX, and .PDF attachments.

Another component, CerealNeuron, receives encrypted web requests that carry commands. It can run CerealRunner programs to retrieve Exchange emails, query Active Directory, extract locally stored credentials, read files, or delete them. ESET also found CerealHermit, a variant without network capabilities that reads commands from encrypted files on disk. The researchers said they could not explain how attackers place those files on a server or retrieve the results.

ESET observed no external command-and-control infrastructure in the attack; the compromised Exchange server served as the control point. The company described Cereal as designed for long-term, stealthy cyberespionage and said it shared indicators of compromise on GitHub.