Turla Uses New Cereal .NET Toolset to Steal Emails From Government Exchange Servers
The Russia-aligned espionage group Turla (also known as Snake) is running a previously undocumented, modular .NET toolset called Cereal on Microsoft Exchange servers to quietly copy selected emails. ESET, which named the toolset, saw it at a government body in Kazakhstan and a government agency in Romania in late 2025 (bleepingcomputer.com). The Romanian victim was reportedly targeted for messages tied to NATO and EU institutional addresses (thehackernews.com). ESET attributes Cereal to Turla with high confidence (helpnetsecurity.com). The initial access vector is unknown, and no CVE or vendor patch is involved, so the realistic defender risk lies in an attacker already holding a foothold on the mail server. Urgency is rated high rather than critical: this is a targeted espionage campaign against government victims, not a mass-exploited flaw.
Detalhes técnicos
Cereal is built from eight components that work together (thehackernews.com):
- CerealRunner: the operator-deployed entry point that drops the other components and runs command payloads in memory.
- CerealLoader: loads a .NET assembly from an encrypted file on disk and starts CerealSprinter.
- CerealSprinter: decrypts and runs CerealNeuron, CerealHermit and CerealBox.
- CerealIron: an injector that loads .NET assemblies into non-.NET processes.
- CerealMoth: loads an assembly and invokes a named method inside it.
- CerealNeuron: a passive backdoor on the Exchange server that listens for web requests on paths resembling normal Exchange traffic.
- CerealHermit: a CerealNeuron variant with no network function that reads commands from encrypted files on disk.
- CerealBox: the email harvester. It injects into the Exchange transport process EdgeTransport.exe, filters messages with DOC, DOCX or PDF attachments against hard-coded lists, and stages the matches as encrypted, compressed files before exfiltration.
No external command-and-control infrastructure was observed; the compromised Exchange server serves as the only control point (bleepingcomputer.com). Operators send commands as separate compiled .NET programs. Supported tasks include retrieving mailboxes or messages, querying Active Directory, running WMI queries, extracting LSA Secrets, listing volume snapshots and performing file operations. ESET's researcher described the large number of near-identical, task-specific binaries as evidence of an internal build and packaging framework (thehackernews.com).
Remediação
No CVE, vendor advisory or Microsoft patch is named in the article or in the sources checked, so the response is detection and hunting on the Exchange estate. Review EdgeTransport.exe for unexpected injected code and transport agent handler changes, look for .NET assemblies loaded from encrypted files in unusual locations, and check IIS logs for requests to unfamiliar paths that mimic Exchange traffic. Treat any Exchange server in a government or NATO/EU-facing organization as a possible collection point and review its mail flow rules and recent administrative activity. The ESET report itself was not retrieved; the technical details above come from the article and from search excerpts of bleepingcomputer.com and helpnetsecurity.com.
Linha do tempo
-
Turla Uses New Cereal .NET Toolset to Steal Emails From Government Exchange Servers
ler a análise desta fonte ocultar
The Russia-aligned espionage group Turla (also known as Snake) is running a previously undocumented, modular .NET toolset called Cereal on Microsoft Exchange servers to quietly copy selected emails. ESET, which named the toolset, saw it at a government body in Kazakhstan and a government agency in Romania in late 2025 (bleepingcomputer.com). The Romanian victim was reportedly targeted for messages tied to NATO and EU institutional addresses (thehackernews.com). ESET attributes Cereal to Turla with high confidence (helpnetsecurity.com). The initial access vector is unknown, and no CVE or vendor patch is involved, so the realistic defender risk lies in an attacker already holding a foothold on the mail server. Urgency is rated high rather than critical: this is a targeted espionage campaign against government victims, not a mass-exploited flaw.
Technical Details
Cereal is built from eight components that work together (thehackernews.com):
- CerealRunner: the operator-deployed entry point that drops the other components and runs command payloads in memory.
- CerealLoader: loads a .NET assembly from an encrypted file on disk and starts CerealSprinter.
- CerealSprinter: decrypts and runs CerealNeuron, CerealHermit and CerealBox.
- CerealIron: an injector that loads .NET assemblies into non-.NET processes.
- CerealMoth: loads an assembly and invokes a named method inside it.
- CerealNeuron: a passive backdoor on the Exchange server that listens for web requests on paths resembling normal Exchange traffic.
- CerealHermit: a CerealNeuron variant with no network function that reads commands from encrypted files on disk.
- CerealBox: the email harvester. It injects into the Exchange transport process EdgeTransport.exe, filters messages with DOC, DOCX or PDF attachments against hard-coded lists, and stages the matches as encrypted, compressed files before exfiltration.
No external command-and-control infrastructure was observed; the compromised Exchange server serves as the only control point (bleepingcomputer.com). Operators send commands as separate compiled .NET programs. Supported tasks include retrieving mailboxes or messages, querying Active Directory, running WMI queries, extracting LSA Secrets, listing volume snapshots and performing file operations. ESET's researcher described the large number of near-identical, task-specific binaries as evidence of an internal build and packaging framework (thehackernews.com).
Remediation
No CVE, vendor advisory or Microsoft patch is named in the article or in the sources checked, so the response is detection and hunting on the Exchange estate. Review EdgeTransport.exe for unexpected injected code and transport agent handler changes, look for .NET assemblies loaded from encrypted files in unusual locations, and check IIS logs for requests to unfamiliar paths that mimic Exchange traffic. Treat any Exchange server in a government or NATO/EU-facing organization as a possible collection point and review its mail flow rules and recent administrative activity. The ESET report itself was not retrieved; the technical details above come from the article and from search excerpts of bleepingcomputer.com and helpnetsecurity.com.