Introduction
The Russian state-backed threat group Turla has been using a novel malicious toolset called 'Cereal' to spy on govt Exchange servers at government organizations. Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular.NET malware at a government body in Kazakhstan. A month later, ESET discovered the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB). ### Cereal Malware Toolset
The Cereal toolset, specifically a component named CerealBox, injects into Exchange’s EdgeTransport.exe process and hijacks existing transport agents' handlers. The malware executes commands in memory and can inspect email content without registering a new transport agent or interrupting normal email delivery in the Exchange server. Turla configured the malware to selectively collect messages containing document attachments such as.DOC.DOCX and.PDF files, and match certain sender, recipient, and subject criteria. Another malware component, called CerealNeuron, awaits for incoming encrypted web requests on paths resembling legitimate Exchange services, which carry commands for execution. CerealNeuron checks and decrypts the request, then executes the supplied CerealRunner program, a wrapper program that carries the code the attackers want to execute. Commands may include code to retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read files, or delete files. The CerealRunner components contain encrypted.NET programs and the arguments needed to run them, which execute in the host’s memory and then return their output to CerealNeuron. Eventually, CerealNeuron encrypts the output and sends it back to the attackers. ### Cereal Variant: CerealHermit
ESET uncovered a variant of CerealNeuron called CerealHermit, which lacks network capabilities and instead reads commands from encrypted files on the disk. CerealHermit may serve as a fallback/redundancy system for when Neuron’s web channel becomes unavailable. However, ESET did not explain how attackers place Hermit’s command files on the server or retrieve the execution results. ### Advanced Concealment Methods
The Cereal toolset features advanced concealment methods, demonstrating Turla’s deep understanding of.NET execution techniques, including abusing the.NET native image cache to run inside legitimate processes. ESET notes that the Cereal toolset was designed for 'long-term, stealthy cyberespionage,' featuring a small disk footprint and relying on infrastructure that is less likely to be detected and blocked. ### Conclusion
The Cereal malware toolset, combined with Turla’s advanced concealment methods, underscores the sophistication of the threat group and the importance of robust security measures to protect government Exchange servers. ESET has shared an extended list of indicators of compromise (IoCs) on its GitHub page for further analysis and defense. Adaptive Security’s AI agents can analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud, providing an additional layer of protection against such threats.
