Turla deploys new Cereal .NET toolset on government Exchange servers in Kazakhstan and Romania, using the server itself as C2
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:04; os links antigos trazem para cá.
ESET attributes with high confidence to Turla (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) a previously undocumented .NET toolset called Cereal, deployed on Microsoft Exchange Server at two government bodies, in Kazakhstan and Romania (securityaffairs.com). Infosecurity Magazine reports that ESET ties the group to the Russian FSB (infosecurity-magazine.com). ESET found the toolset in Kazakhstan on 28 November 2025, and the Romanian body was compromised on 23 December (securityaffairs.com). In Romania, the email collection module was set up to copy messages sent to or from NATO and EU addresses (infosecurity-magazine.com; securityaffairs.com). Cereal needs no attacker-owned command server: the compromised Exchange server itself acts as C2, and ESET saw no external infrastructure or operator IP addresses (welivesecurity.com; bleepingcomputer.com). ESET has not explained how initial access was gained, and no Exchange vulnerability or CVE is named, so this is post-compromise espionage (cybersecuritynews.com). Turla has been active since at least 2004, targeting diplomatic and government organizations and private businesses worldwide (securityaffairs.com).
Detalhes técnicos
- The toolset is modular: CerealLoader, CerealRunner, CerealNeuron, CerealBox and CerealHermit (cyberpress.org; welivesecurity.com).
- CerealNeuron is the passive main backdoor. It listens for web requests on paths that resemble Outlook Web Access, Autodiscover and ActiveSync, so the traffic looks like ordinary mail use (cyberpress.org; helpnetsecurity.com).
- Each operator command is a small, separately compiled .NET program carried in encrypted containers and run in memory. The number of near-identical binaries suggests an internal build framework (welivesecurity.com; bleepingcomputer.com). Observed tasks include retrieving email, querying Active Directory, extracting locally stored credentials, and reading or deleting files (bleepingcomputer.com).
- CerealBox is the email collection module. It runs inside EdgeTransport.exe, the Exchange transport process, and hooks the mail pipeline from the inside. ESET says no malware family has documented this technique before (welivesecurity.com; helpnetsecurity.com). No new transport agent appears in the Exchange configuration, and the original message keeps flowing (helpnetsecurity.com).
- Collection is selective. CerealBox picks messages with DOC, DOCX or PDF attachments that match configured senders, recipients, subject text or attachment names, and runs before normal delivery resumes (cyberpress.org). Selected messages are compressed, encrypted and staged on the server until operators retrieve and delete them (gbhackers.com; cybersecuritynews.com).
- CerealHermit is a second backdoor that reads encrypted commands from disk rather than from the network (cybersecuritynews.com; cyberpress.org).
- Attribution rests on the concurrent use of another component publicly linked to Turla and on similarities with older Turla tools, including the Exchange backdoor LightNeuron (mlq.ai; gbhackers.com).
Remediação
- ESET's white paper and GitHub repository publish a list of indicators of compromise (welivesecurity.com; bleepingcomputer.com). The source text is truncated at this point, so further guidance is not available here.
- Treat any government Exchange server as a potential collection point and hunt for the Cereal components (infosecurity-magazine.com). Because the traffic imitates OWA, Autodiscover and ActiveSync and there is no external C2, review activity inside Exchange hosts (such as EdgeTransport.exe behavior) rather than relying on network-perimeter indicators alone.
Linha do tempo
-
Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room
ler a análise desta fonte ocultar
ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania.
ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December. The researchers discovered that in Romania, it was set up to spot emails to or from NATO and the European Union. ESET attributes it with high confidence to the Turla APT group (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2004, targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.
-
Turla's Cereal toolset turns government Exchange servers into email-collection and C2 hubs
ler a análise desta fonte ocultar
Turla, a Russia-aligned group that ESET attributes to the FSB with high confidence, has deployed a previously undocumented .NET toolset called Cereal on Microsoft Exchange Server environments of two government organisations, one in Kazakhstan and one in Romania. In Romania, the email collection module was set to copy messages sent to or from NATO and EU addresses. The toolset needs no attacker-owned command server: the compromised Exchange server itself serves as C2, and ESET saw no external infrastructure or operator IP addresses (welivesecurity.com; bleepingcomputer.com). ESET has not explained how the initial access was gained, and no Exchange vulnerability or CVE is named in its research, so the activity is post-compromise espionage (cybersecuritynews.com). Defenders should treat any government Exchange server as a potential collection point and hunt for the Cereal components.
Technical Details
- The toolset is modular: CerealLoader, CerealRunner, CerealNeuron, CerealBox and CerealHermit (cyberpress.org; welivesecurity.com). CerealNeuron is the passive main backdoor. It listens for web requests on paths that resemble Outlook Web Access, Autodiscover and ActiveSync, so the traffic looks like ordinary mail use (cyberpress.org; helpnetsecurity.com).
- Operators send each command as a small, separately compiled .NET program carried in encrypted containers and run in memory. The sheer number of near-identical binaries suggests an internal build framework (welivesecurity.com; bleepingcomputer.com). Observed tasks include retrieving email, querying Active Directory, extracting locally stored credentials, and reading or deleting files (bleepingcomputer.com).
- CerealBox is the email collection module. It runs inside EdgeTransport.exe, the Exchange transport process, and hooks the mail pipeline from the inside. ESET says no malware family has documented this technique before (welivesecurity.com; helpnetsecurity.com). No new transport agent appears in the Exchange configuration, and the original message keeps flowing (helpnetsecurity.com).
- Collection is selective. CerealBox picks messages with DOC, DOCX or PDF attachments that match configured senders, recipients, subject text or attachment names, and runs its logic before normal delivery resumes (cyberpress.org). Selected messages are compressed, encrypted and staged on the server until operators retrieve and delete them (gbhackers.com; cybersecuritynews.com).
- CerealHermit is a second backdoor that reads encrypted commands from disk rather than from the network (cybersecuritynews.com; cyberpress.org).
- Attribution rests on the concurrent use of another component publicly linked to Turla and on similarities with older Turla tools, including the Exchange backdoor LightNeuron (mlq.ai; gbhackers.com).
Remediation
- ESET's white paper and its GitHub repository publish a list of indicators of compromise (welivesecurity.com; bleepingcomputer.com). The article itself lists none, so none are recorded here. Analysts should pull that list and check Exchange servers against it.
- No vendor fix applies, because the activity depends on existing server access rather than a flaw in Exchange (cybersecuritynews.com). Analyst recommendation: review EdgeTransport.exe for unexpected injected code and review web-facing Exchange request logs for unusual encrypted requests.