Turla's Cereal toolset turns Exchange servers into email collection hubs at Kazakh and Romanian governments
Turla (also tracked as Snake, widely assessed to be part of Russia's FSB) planted the Cereal modular .NET toolset on Microsoft Exchange servers at two government bodies, one in Kazakhstan and one in Romania, and used it to copy selected email from the mail flow. ESET first found the toolset on November 28, 2025 at the Kazakh organization, then found the Romanian victim, compromised December 23, 2025, after tuning its detections. In Romania the email collection module was set to flag messages exchanged with NATO and EU addresses. Command traffic is relayed through the victim's own internet-facing Exchange server, so no attacker-owned command server is needed, and ESET could not identify the operator IP addresses. Neither the article nor the ESET write-up names a CVE or a vendor patch, and the initial access method is not described, so the threat depends on operators already having control of the server. Criticity is high: this is a state-linked espionage campaign with confirmed government victims, but defenders have no vulnerability to patch and must hunt for the implant.
Detalhes técnicos
- CerealNeuron, the main backdoor, listens for encrypted web requests on Exchange-like paths such as /owa/sdds/ and /autodiscover/proxyservice/. It decrypts and runs only requests that pass several integrity checks, and answers anything else with a normal-looking Exchange error page (welivesecurity.com). Commands arrive as small, purpose-built .NET executables, and the number of near-identical binaries suggests an automated command framework (welivesecurity.com). Observed tasks include mailbox pulls, Active Directory queries, LSA secret extraction and reading or deleting files.
- CerealHermit is a variant without network functions that reads encrypted command files from disk, giving operators a fallback channel (welivesecurity.com).
- CerealBox runs inside EdgeTransport.exe and wraps the handlers of transport agents already loaded in memory. No new agent is registered in Exchange's configuration. It keeps messages carrying .doc, .docx or .pdf attachments that match hardcoded senders, recipients, subjects or attachment names, then compresses, encrypts and stages them on disk. ESET says no malware family had been documented hooking the transport service from inside before (welivesecurity.com).
- CerealLoader is the only component stored on disk as a recognizable .NET file, and it runs native code before the .NET runtime starts. In one chain it was placed as ncobjapi.dll in C:\Windows\System32\wbem, where WMI loads it automatically; in another it impersonated wbemcomn.dll. Operators also planted copies such as Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache, and Exchange loaded the malicious file before the genuine library (welivesecurity.com).
- Other components in the toolset are CerealRunner and CerealSprinter (encrypted containers that load and run further binaries), CerealIron (injects .NET assemblies into non-.NET processes) and CerealMoth (loads an assembly and calls a named method). ESET named Neuron after a Turla family the UK NCSC documented in 2017 (welivesecurity.com).
Remediação
No vendor advisory or mitigation guidance appears in the sources reviewed. ESET points to indicators of compromise in its GitHub repository and to a white paper (welivesecurity.com), which were not opened during this research.
Linha do tempo
-
Turla's Cereal toolset turns Exchange servers into email collection hubs at Kazakh and Romanian governments
ler a análise desta fonte ocultar
Turla (also tracked as Snake, widely assessed to be part of Russia's FSB) planted the Cereal modular .NET toolset on Microsoft Exchange servers at two government bodies, one in Kazakhstan and one in Romania, and used it to copy selected email from the mail flow. ESET first found the toolset on November 28, 2025 at the Kazakh organization, then found the Romanian victim, compromised December 23, 2025, after tuning its detections. In Romania the email collection module was set to flag messages exchanged with NATO and EU addresses. Command traffic is relayed through the victim's own internet-facing Exchange server, so no attacker-owned command server is needed, and ESET could not identify the operator IP addresses. Neither the article nor the ESET write-up names a CVE or a vendor patch, and the initial access method is not described, so the threat depends on operators already having control of the server. Criticity is high: this is a state-linked espionage campaign with confirmed government victims, but defenders have no vulnerability to patch and must hunt for the implant.
Technical Details
- CerealNeuron, the main backdoor, listens for encrypted web requests on Exchange-like paths such as /owa/sdds/ and /autodiscover/proxyservice/. It decrypts and runs only requests that pass several integrity checks, and answers anything else with a normal-looking Exchange error page (welivesecurity.com). Commands arrive as small, purpose-built .NET executables, and the number of near-identical binaries suggests an automated command framework (welivesecurity.com). Observed tasks include mailbox pulls, Active Directory queries, LSA secret extraction and reading or deleting files.
- CerealHermit is a variant without network functions that reads encrypted command files from disk, giving operators a fallback channel (welivesecurity.com).
- CerealBox runs inside EdgeTransport.exe and wraps the handlers of transport agents already loaded in memory. No new agent is registered in Exchange's configuration. It keeps messages carrying .doc, .docx or .pdf attachments that match hardcoded senders, recipients, subjects or attachment names, then compresses, encrypts and stages them on disk. ESET says no malware family had been documented hooking the transport service from inside before (welivesecurity.com).
- CerealLoader is the only component stored on disk as a recognizable .NET file, and it runs native code before the .NET runtime starts. In one chain it was placed as ncobjapi.dll in C:\Windows\System32\wbem, where WMI loads it automatically; in another it impersonated wbemcomn.dll. Operators also planted copies such as Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache, and Exchange loaded the malicious file before the genuine library (welivesecurity.com).
- Other components in the toolset are CerealRunner and CerealSprinter (encrypted containers that load and run further binaries), CerealIron (injects .NET assemblies into non-.NET processes) and CerealMoth (loads an assembly and calls a named method). ESET named Neuron after a Turla family the UK NCSC documented in 2017 (welivesecurity.com).
Remediation
No vendor advisory or mitigation guidance appears in the sources reviewed. ESET points to indicators of compromise in its GitHub repository and to a white paper (welivesecurity.com), which were not opened during this research.