Turla Cereal Malware Hits Government Exchange Servers
TL;DR
Security researchers discovered a modular .NET toolset called Turla Cereal malware targeting government Microsoft Exchange servers. The attackers compromised state agencies in Kazakhstan and Romania without setting up external command servers. Instead, this Turla Cereal malware Exchange intrusion turns the victim’s own email server into an operational base to intercept diplomatic communications.
What Happened in the Intrusions
In late 2025, security researchers detected a new set of cyber espionage tools running inside a government network in Kazakhstan. According to a detailed investigation by ESET into Turla’s Cereal toolset, the operators deployed several interconnected .NET modules across compromised systems. A few weeks later, analysts identified the same components inside a government agency in Romania.
“Because the tools rely heavily on serialization (a technique for packaging data and code for transport), we have given them names that start with the prefix ‘Cereal’,” ESET researchers wrote. Unlike typical malware, the toolset uses almost no external command servers. “One of the most interesting aspects of this toolset is what we did not find: external command and control (C&C) infrastructure,” the report stated. Instead, the victim’s own email server functions as the central management hub.
Modular .NET Architecture and Passive Execution
The malware chain begins with CerealLoader, the only component written to disk as an unencrypted binary. CerealLoader abuses a rare feature called VTable Fixups to run native machine code before the .NET runtime starts. Consequently, static decompilers see empty methods that do nothing. Furthermore, the operators dropped CerealLoader into Windows system folders as ncobjapi.dll or wbemcomn.dll to hijack legitimate management services. Attackers also placed files into the .NET native image cache to run code whenever the Exchange search process starts.
Once loaded, CerealLoader decrypts CerealSprinter and CerealRunner entirely in memory. CerealRunner carries small, compiled .NET programs built for individual tasks, such as querying Active Directory or extracting local passwords. To receive commands, the operators deploy CerealNeuron. This passive backdoor listens for incoming web requests on paths like /owa/sdds/ and /autodiscover/proxyservice/. “Instead of initiating outbound connections, it waits for incoming requests,” ESET explained. If a network request contains valid decryption keys, CerealNeuron executes the payload in memory. Meanwhile, a non-network variant named CerealHermit reads command files directly from disk.
CerealBox Intercepts Exchange Mail Flow
The most remarkable component in the framework is CerealBox, an email harvesting tool. Rather than registering as an official transport agent, the malware injects directly into EdgeTransport.exe. It then locates active transport agents in memory and wraps their handlers with custom inspection logic. “CerealBox doesn’t add a new agent; it hijacks existing ones loaded in memory,” ESET researchers observed.
Therefore, the original email flow continues without triggering configuration alerts. CerealBox inspects all outbound and inbound messages for PDF, DOC, and DOCX attachments. When a message matches specific sender or recipient addresses, the tool encrypts and saves a copy to disk. The operators later retrieve the stolen files using CerealNeuron web requests.
Who Is Behind the Activity
ESET attributes the campaign to the Russia-aligned advanced persistent threat group Turla with high confidence. Operating since at least 2004, Western intelligence agencies and the UK National Cyber Security Centre (NCSC) link Turla to Russia’s Federal Security Service (FSB). ESET researchers previously connected Turla to similar tools, including the legacy Neuron malware family.
Furthermore, the campaign’s timing matches Russian cultural calendars. Activity in Kazakhstan surged sharply on January 15, 2026, the day after the informal Old New Year holiday celebrated in Russia. The codebase also shows signs of an automated build system that produces near-identical binaries for specific tasks.
Impact and Espionage Scale
The Turla Cereal malware campaign focused on high-level geopolitical intelligence across Eastern Europe and Central Asia. In Romania, operators configured CerealBox to filter messages sent to or received from NATO and European Union institutional addresses. This espionage occurred alongside rising regional friction caused by Russian drone incursions near Romanian territory.
Meanwhile, the intrusion in Kazakhstan targeted government databases during a period of political tension. Since early 2026, Kazakh authorities have begun deporting certain Russian political exiles. By gaining deep access to Kazakh government mail servers, the attackers likely sought advance visibility into dissidents living abroad.
How Organizations Can Stay Protected
Because Turla Cereal malware Exchange backdoors do not establish outbound connections, standard perimeter firewall blocks will fail. “The victim’s own internet-facing Exchange server is the operator-accessible control point,” the ESET report warned. Therefore, defenders must hunt for threats from the inside out.
Security teams should inspect IIS web logs for unusual requests to /owa/sdds/ and /autodiscover/proxyservice/ endpoints. Administrators should also audit the .NET native image cache for unauthorized DLLs mimicking Exchange search components. Furthermore, defenders must check C:\Windows\System32\wbem\ for unverified DLL files like ncobjapi.dll. Finally, organizations should monitor EdgeTransport.exe memory space for injected code and apply multi-factor authentication across all external access portals.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
