A Russia-aligned threat actor known as Turla has unleashed a sophisticated malware suite called “Cereal,” aimed at turning Microsoft Exchange servers into stealthy tools for email exfiltration and remote control. Exclusive research revealed that government institutions in Kazakhstan and Romania were targeted, with attackers filtering messages based on EU- and NATO-related addresses to maximize intelligence value. Service remained operational, masking the intrusion for months.
What Is Cereal and How It Operates
First identified in a Kazakh government server on November 28, 2025, Cereal’s presence was later confirmed in Romania, dating back to December 23, 2025. The malware is designed to evade detection by allowing legitimate email delivery to proceed while quietly copying select messages. In Romania, the malware focused on correspondence involving domains like nato.int and europa.eu, signaling a targeted campaign for geopolitical intelligence rather than broad-scale theft.
Cereal includes several components, each playing a distinct role. CerealLoader—its only component visible on disk as an unencrypted .NET file—delivers the other payloads. Other modules arrive in encrypted containers, making forensic analysis more difficult. Key components include:
- CerealNeuron: A passive backdoor that listens for incoming commands via existing Exchange paths (e.g., OWA, Autodiscover, ActiveSync) instead of reaching out to external servers. This helps malicious control traffic look like normal Exchange operations.
- CerealRunner: Executes a variety of encrypted tasks—harvesting mail via Exchange Web Services, probing Active Directory, checking processes, extracting credential data, and handling files.
- CerealHermit: A disk-based backdoor, reading encrypted instructions stored locally rather than using the network.
- CerealBox: The component that taps into Exchange’s mail flow. It runs inside the EdgeTransport.exe process, intercepting messages in memory through hooks, not by installing new transport agents. It filters messages by attachment type and subject or sender criteria, compresses and encrypts chosen content, and then stores it locally for later retrieval by the attackers.
Detection Challenges and Entry Points
Attackers used several stealth methods: hiding code inside trusted processes, using DLL search-order hijacking, placing loaders in the .NET native image cache, and only partially exposing modules to detection. Defenders checking for new transport agents or abnormal external connections might miss much of what Cereal is doing.
How Turla gained initial access remains unclear. Although the targeted servers were internet-facing, there’s no solid evidence yet of what vulnerability or entry method the attackers used. The report doesn’t link the attack to phishing, stolen credentials, or a new zero-day—only that the malware operates post-compromise.
ESET, the research outfit behind this discovery, attributes the toolset to Turla with high confidence. Similar code was found alongside known Turla malware in earlier operations, fitting the group’s pattern of long-term espionage against governments and diplomatic bodies.
This kind of targeted, carefully tuned operation marks a step forward in malware sophistication: selecting specific politicians or agencies, rather than opening the floodgates.
Analytical Angle: Turla’s “Cereal” represents a new tier of stealth in state-sponsored cyber espionage. By embedding itself deeply in core email infrastructure and routing control through legitimate service paths rather than separate command servers, the attackers reduce the noise that normally triggers alerts. Organizations running internet-facing Microsoft Exchange servers must assume if they haven’t already, that their email traffic could be silently targeted. Watch for expanded indicators of compromise—especially around internal paths like EdgeTransport.exe, OWA, Autodiscover, and ActiveSync—and updated threat intelligence that may finally unmask what’s been lurking unseen for months.
