Turla usa o toolset .NET Cereal para copiar e-mails de servidores Microsoft Exchange de governos do Cazaquistão e da Romênia

Linha do tempo

1. gbhackers.com ↗ · pub. 10/11/2026 08:30 · coletado 10/11 10:00

   Turla Deploys Cereal .NET Toolkit on Microsoft Exchange Servers to Intercept Government Email

   ler a análise desta fonte ocultar

   ESET attributes Cereal, a previously undocumented modular .NET toolset, to the Russia-aligned Turla group with high confidence. The kit turns compromised Microsoft Exchange servers into email-collection and command platforms: a passive backdoor waits for crafted HTTPS requests hidden among normal Exchange web traffic, while a module in the transport pipeline copies selected messages without stopping their delivery. ESET found the toolset at a governmental organization in Kazakhstan on November 28, 2025, then at a Romanian governmental organization compromised from December 23, 2025, where collection targeted correspondence involving NATO and EU institutional addresses. Initial access is undetermined; exploitation of an internet-facing Exchange vulnerability is possible but unconfirmed. Because the operators use the victim's own server as the control point and no external C2 was observed, network blocking and a review of registered transport agents would not reveal the implant.

   Technical Details

   • CerealNeuron, the passive backdoor, listens for HTTPS requests on paths such as /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/. Requests that pass encryption and integrity checks receive commands; invalid requests are redirected to legitimate-looking Exchange error pages.
   • CerealRunner containers carry one compiled .NET assembly per task, executed in memory for mailbox retrieval through Exchange Web Services, Active Directory reconnaissance, WMI queries, LSA Secrets extraction, snapshot enumeration and file operations.
   • CerealHermit is a variant with no network functionality (welivesecurity.com); it reads encrypted commands from disk and writes encrypted results.
   • CerealBox is injected into EdgeTransport.exe. Instead of registering a rogue transport agent, it wraps the handlers of agents already loaded in memory, runs its collection logic, then returns control to the legitimate code.
   • Collection selects messages carrying a .doc, .docx or .pdf attachment that match sender, recipient, subject or attachment-name rules and no exclusion rule. Selected items are compressed, encrypted and staged locally until the operators retrieve and delete them.
   • CerealLoader uses unmanaged entry points and VTable Fixups to bridge native execution into managed methods, which conventional .NET inspection can miss. Some deployment chains hijack Windows DLL loading or abuse the .NET native image cache under filenames such as Microsoft.Exchange.Search.Mdb.ni.dll.
   • ESET links the design conceptually to LightNeuron, Turla's earlier Exchange backdoor that received commands hidden in email attachments.

   Remediation

   Neither the ESET write-up nor the search results reviewed name a CVE or a vendor patch for this activity, so the defensive guidance is detection-oriented. Hunt for requests to the listed paths in Exchange web logs, look for the Microsoft.Exchange.Search.Mdb.ni.dll filename and unexpected module loads, inspect EdgeTransport.exe process memory for wrapped handlers, and search for compressed or encrypted staging files. Investigations need visibility into process memory and unexpected module loads, alongside Exchange web requests and encrypted staging files, because mail delivery and the transport-agent inventory look normal.

2. helpnetsecurity.com ↗ · pub. 10/11/2026 07:00 · coletado 10/11 09:01

   Turla's Cereal toolset turns Exchange servers into email collection hubs at Kazakh and Romanian governments

   ler a análise desta fonte ocultar

   Turla (also tracked as Snake, widely assessed to be part of Russia's FSB) planted the Cereal modular .NET toolset on Microsoft Exchange servers at two government bodies, one in Kazakhstan and one in Romania, and used it to copy selected email from the mail flow. ESET first found the toolset on November 28, 2025 at the Kazakh organization, then found the Romanian victim, compromised December 23, 2025, after tuning its detections. In Romania the email collection module was set to flag messages exchanged with NATO and EU addresses. Command traffic is relayed through the victim's own internet-facing Exchange server, so no attacker-owned command server is needed, and ESET could not identify the operator IP addresses. Neither the article nor the ESET write-up names a CVE or a vendor patch, and the initial access method is not described, so the threat depends on operators already having control of the server. Criticity is high: this is a state-linked espionage campaign with confirmed government victims, but defenders have no vulnerability to patch and must hunt for the implant.

   Technical Details

   • CerealNeuron, the main backdoor, listens for encrypted web requests on Exchange-like paths such as /owa/sdds/ and /autodiscover/proxyservice/. It decrypts and runs only requests that pass several integrity checks, and answers anything else with a normal-looking Exchange error page (welivesecurity.com). Commands arrive as small, purpose-built .NET executables, and the number of near-identical binaries suggests an automated command framework (welivesecurity.com). Observed tasks include mailbox pulls, Active Directory queries, LSA secret extraction and reading or deleting files.
   • CerealHermit is a variant without network functions that reads encrypted command files from disk, giving operators a fallback channel (welivesecurity.com).
   • CerealBox runs inside EdgeTransport.exe and wraps the handlers of transport agents already loaded in memory. No new agent is registered in Exchange's configuration. It keeps messages carrying .doc, .docx or .pdf attachments that match hardcoded senders, recipients, subjects or attachment names, then compresses, encrypts and stages them on disk. ESET says no malware family had been documented hooking the transport service from inside before (welivesecurity.com).
   • CerealLoader is the only component stored on disk as a recognizable .NET file, and it runs native code before the .NET runtime starts. In one chain it was placed as ncobjapi.dll in C:\Windows\System32\wbem, where WMI loads it automatically; in another it impersonated wbemcomn.dll. Operators also planted copies such as Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache, and Exchange loaded the malicious file before the genuine library (welivesecurity.com).
   • Other components in the toolset are CerealRunner and CerealSprinter (encrypted containers that load and run further binaries), CerealIron (injects .NET assemblies into non-.NET processes) and CerealMoth (loads an assembly and calls a named method). ESET named Neuron after a Turla family the UK NCSC documented in 2017 (welivesecurity.com).

   Remediation

   No vendor advisory or mitigation guidance appears in the sources reviewed. ESET points to indicators of compromise in its GitHub repository and to a white paper (welivesecurity.com), which were not opened during this research.

3. cyberscoop.com ↗ · pub. 10/11/2026 07:00 · coletado 10/11 09:00

   Russia-aligned Turla uses new Cereal toolset to spy on Kazakh and Romanian government Exchange email

   ler a análise desta fonte ocultar

   Turla, a cyberespionage group that Western governments attribute to Russia's FSB, has been using a modular .NET toolset called Cereal to collect email from government Microsoft Exchange servers. ESET found it on a compromised Exchange server used by the government of Kazakhstan on November 28, 2025, and a second version inside a Romanian government agency a month later, configured to target mail to and from the EU and NATO. The toolset has no external command-and-control infrastructure: the victim's own Exchange server serves as the C2 point, so there is no domain, IP address or hosting pattern to block. The article reports no CVE and does not say how the servers were first compromised, so the initial access vector is unknown. No vendor severity score or fix applies, because the toolset runs only on servers the operators have already compromised, and the threat is confirmed espionage against governments rather than a mass-exploitation event.

   Technical Details

   • The Cereal toolset chains and exploits legitimate functions across Microsoft Exchange, Windows and .NET assemblies, and most executables run in memory using temporary storage.
   • CerealNeuron is the main backdoor. It does not beacon out; it passively listens for web requests on paths that resemble ordinary Exchange traffic, and encrypted payloads deliver commands (article).
   • CerealBox injects into the Exchange EdgeTransport.exe process and hijacks existing transport agent handlers to copy mail flow (bleepingcomputer.com).
   • CerealHermit is a variant of CerealNeuron with no network capability. It reads encrypted command files from disk and may serve as a fallback channel (bleepingcomputer.com).
   • ESET attributes the toolset to Turla with high confidence, based on a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com).
   • ESET's press release also names the group Snake, active since at least 2004 (globenewswire.com).
4. bleepingcomputer.com ↗ · pub. 10/11/2026 07:04 · coletado 10/11 08:00

   Turla Deploys Cereal .NET Toolset to Intercept Email on Government Exchange Servers

   ler a análise desta fonte ocultar

   The Russia-linked espionage group Turla (also tracked as Snake and Secret Blizzard, and linked by the article to Russia's FSB) has been running Cereal, a modular .NET toolset, on Microsoft Exchange servers of government bodies, as documented by ESET. ESET first found the toolset at a government body in Kazakhstan and later at a Romanian government agency, where the operators selectively copied email exchanged with NATO and EU representatives. The malware copies selected messages from the mail flow without registering a new transport agent or interrupting delivery, and it uses the compromised server itself as the only control point. Criticity is rated high because this is a targeted intrusion against government mail systems, but no CVE is involved and the article does not state how the attackers got in, which limits the immediate exposure for organisations outside these targets.

   Technical Details

   CerealBox injects into the Exchange EdgeTransport.exe process and wraps the handlers of transport agents already loaded in memory, so the malware inspects email content without adding a new transport agent (bleepingcomputer.com). It is configured to collect messages carrying .DOC, .DOCX or .PDF attachments that match sender, recipient or subject criteria (bleepingcomputer.com). CerealNeuron listens for encrypted web requests on paths that resemble Exchange services, such as /owa/sdds/ and /autodiscover/proxyservice/ (helpnetsecurity.com), decrypts them and runs the CerealRunner wrapper programs that carry the code the operators want executed. Those commands can retrieve email from Exchange, query Active Directory, extract credentials Windows stores locally, and read or delete files, and the output is encrypted and returned to the operators (bleepingcomputer.com). ESET observed no external command-and-control infrastructure and could not identify the IP addresses the operators connected from (helpnetsecurity.com). CerealHermit, a variant without network capabilities, reads encrypted command files from disk and likely serves as a fallback; ESET did not explain how the command files are placed or how results are retrieved (bleepingcomputer.com). The toolset abuses the .NET native image cache to run inside legitimate processes and keeps a small disk footprint (bleepingcomputer.com). ESET attributes Cereal to Turla with high confidence, citing a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com). ESET published an extended list of IoCs on its GitHub page, which was not opened for this record.

5. thehackernews.com ↗ · pub. 10/11/2026 07:07 · coletado 10/11 08:00 primeiro registro

   Turla Uses New Cereal .NET Toolset to Steal Emails From Government Exchange Servers

   ler a análise desta fonte ocultar

   The Russia-aligned espionage group Turla (also known as Snake) is running a previously undocumented, modular .NET toolset called Cereal on Microsoft Exchange servers to quietly copy selected emails. ESET, which named the toolset, saw it at a government body in Kazakhstan and a government agency in Romania in late 2025 (bleepingcomputer.com). The Romanian victim was reportedly targeted for messages tied to NATO and EU institutional addresses (thehackernews.com). ESET attributes Cereal to Turla with high confidence (helpnetsecurity.com). The initial access vector is unknown, and no CVE or vendor patch is involved, so the realistic defender risk lies in an attacker already holding a foothold on the mail server. Urgency is rated high rather than critical: this is a targeted espionage campaign against government victims, not a mass-exploited flaw.

   Technical Details

   Cereal is built from eight components that work together (thehackernews.com):

   • CerealRunner: the operator-deployed entry point that drops the other components and runs command payloads in memory.
   • CerealLoader: loads a .NET assembly from an encrypted file on disk and starts CerealSprinter.
   • CerealSprinter: decrypts and runs CerealNeuron, CerealHermit and CerealBox.
   • CerealIron: an injector that loads .NET assemblies into non-.NET processes.
   • CerealMoth: loads an assembly and invokes a named method inside it.
   • CerealNeuron: a passive backdoor on the Exchange server that listens for web requests on paths resembling normal Exchange traffic.
   • CerealHermit: a CerealNeuron variant with no network function that reads commands from encrypted files on disk.
   • CerealBox: the email harvester. It injects into the Exchange transport process EdgeTransport.exe, filters messages with DOC, DOCX or PDF attachments against hard-coded lists, and stages the matches as encrypted, compressed files before exfiltration.

   No external command-and-control infrastructure was observed; the compromised Exchange server serves as the only control point (bleepingcomputer.com). Operators send commands as separate compiled .NET programs. Supported tasks include retrieving mailboxes or messages, querying Active Directory, running WMI queries, extracting LSA Secrets, listing volume snapshots and performing file operations. ESET's researcher described the large number of near-identical, task-specific binaries as evidence of an internal build and packaging framework (thehackernews.com).

   Remediation

   No CVE, vendor advisory or Microsoft patch is named in the article or in the sources checked, so the response is detection and hunting on the Exchange estate. Review EdgeTransport.exe for unexpected injected code and transport agent handler changes, look for .NET assemblies loaded from encrypted files in unusual locations, and check IIS logs for requests to unfamiliar paths that mimic Exchange traffic. Treat any Exchange server in a government or NATO/EU-facing organization as a possible collection point and review its mail flow rules and recent administrative activity. The ESET report itself was not retrieved; the technical details above come from the article and from search excerpts of bleepingcomputer.com and helpnetsecurity.com.