Russia-aligned Turla uses new Cereal toolset to spy on Kazakh and Romanian government Exchange email
Turla, a cyberespionage group that Western governments attribute to Russia's FSB, has been using a modular .NET toolset called Cereal to collect email from government Microsoft Exchange servers. ESET found it on a compromised Exchange server used by the government of Kazakhstan on November 28, 2025, and a second version inside a Romanian government agency a month later, configured to target mail to and from the EU and NATO. The toolset has no external command-and-control infrastructure: the victim's own Exchange server serves as the C2 point, so there is no domain, IP address or hosting pattern to block. The article reports no CVE and does not say how the servers were first compromised, so the initial access vector is unknown. No vendor severity score or fix applies, because the toolset runs only on servers the operators have already compromised, and the threat is confirmed espionage against governments rather than a mass-exploitation event.
Detalhes técnicos
- The Cereal toolset chains and exploits legitimate functions across Microsoft Exchange, Windows and .NET assemblies, and most executables run in memory using temporary storage.
- CerealNeuron is the main backdoor. It does not beacon out; it passively listens for web requests on paths that resemble ordinary Exchange traffic, and encrypted payloads deliver commands (article).
- CerealBox injects into the Exchange EdgeTransport.exe process and hijacks existing transport agent handlers to copy mail flow (bleepingcomputer.com).
- CerealHermit is a variant of CerealNeuron with no network capability. It reads encrypted command files from disk and may serve as a fallback channel (bleepingcomputer.com).
- ESET attributes the toolset to Turla with high confidence, based on a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com).
- ESET's press release also names the group Snake, active since at least 2004 (globenewswire.com).
Linha do tempo
-
Russia-aligned Turla uses new Cereal toolset to spy on Kazakh and Romanian government Exchange email
ler a análise desta fonte ocultar
Turla, a cyberespionage group that Western governments attribute to Russia's FSB, has been using a modular .NET toolset called Cereal to collect email from government Microsoft Exchange servers. ESET found it on a compromised Exchange server used by the government of Kazakhstan on November 28, 2025, and a second version inside a Romanian government agency a month later, configured to target mail to and from the EU and NATO. The toolset has no external command-and-control infrastructure: the victim's own Exchange server serves as the C2 point, so there is no domain, IP address or hosting pattern to block. The article reports no CVE and does not say how the servers were first compromised, so the initial access vector is unknown. No vendor severity score or fix applies, because the toolset runs only on servers the operators have already compromised, and the threat is confirmed espionage against governments rather than a mass-exploitation event.
Technical Details
- The Cereal toolset chains and exploits legitimate functions across Microsoft Exchange, Windows and .NET assemblies, and most executables run in memory using temporary storage.
- CerealNeuron is the main backdoor. It does not beacon out; it passively listens for web requests on paths that resemble ordinary Exchange traffic, and encrypted payloads deliver commands (article).
- CerealBox injects into the Exchange EdgeTransport.exe process and hijacks existing transport agent handlers to copy mail flow (bleepingcomputer.com).
- CerealHermit is a variant of CerealNeuron with no network capability. It reads encrypted command files from disk and may serve as a fallback channel (bleepingcomputer.com).
- ESET attributes the toolset to Turla with high confidence, based on a component publicly linked to Turla and similarities with older Turla malware (helpnetsecurity.com).
- ESET's press release also names the group Snake, active since at least 2004 (globenewswire.com).