Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft

Russia-aligned hacking group Turla is using a newly documented malware toolset called Cereal to turn compromised Microsoft Exchange servers into email collection systems and command centers.

ESET Research disclosed the findings on November 10, 2026, describing attacks against government organizations in Kazakhstan and Romania.

The malware copies selected emails while allowing normal delivery to continue, helping the attackers collect sensitive information without causing an obvious service failure.

Turla Hackers Attacking Exchange Servers

Researchers first detected the toolset at a Kazakh government organization on November 28, 2025. After improving their detection rules, they identified another compromised government organization in Romania, where activity dated to December 23, 2025.

In Romania, the attackers configured the malware to identify messages involving NATO and European Union addresses, including nato.int and europa.eu. These filters point to targeted intelligence collection rather than broad, random email theft.

ESET attributed Cereal to Turla with high confidence, citing its use alongside a previously attributed Turla component and similarities to older malware. The group has targeted governments and diplomatic organizations for years.

Earlier Cybersecuritynews.com coverage of Turla’s cooperation with Gamaredon described another route to long-term spying, with Gamaredon providing access before Turla deployed its Kazuar backdoor.

The researchers could not determine how the attackers initially entered either organization. Although the Exchange servers were internet-facing, exploitation of a software flaw remains only a possibility.

The findings do not establish a particular vulnerability, phishing campaign, or stolen account as the entry point. That distinction matters because Cereal describes activity after compromise, not a confirmed new method for breaking into Exchange.

Cereal takes its name from serialization, a process for packaging program data so it can later be rebuilt. Its components use this approach to carry encrypted .NET programs, unpack them, and run them in memory.

CerealLoader is the only component stored as a recognizable, unencrypted .NET file. Other components arrive inside encrypted containers, reducing the amount of readable malware available for investigators to examine on disk.

Exchange Becomes the Command Center

According to ESET’s technical white paper, CerealNeuron serves as a passive backdoor. Instead of regularly contacting an outside command server, it waits for incoming requests on the compromised Exchange server.

Observed paths include /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/. Their resemblance to normal Exchange services helps malicious requests blend into traffic that organizations need for everyday email access.

Requests that pass encryption and integrity checks deliver programs for execution. Invalid requests receive redirects to an Exchange error page. ESET observed no dedicated external command infrastructure and could not identify the operators’ incoming IP addresses.

This does not mean the malware has no network activity. Rather, the victim’s server becomes the reachable control point, removing a separate attacker-controlled server that defenders might otherwise identify and block.

CerealRunner packages individual tasks as encrypted .NET programs. Observed commands retrieved mail through Exchange Web Services, queried Active Directory, checked processes and connections, extracted locally stored credentials, and managed files.

A second backdoor, CerealHermit, reads encrypted commands from disk instead of the network. This use of compromised systems also echoes earlier reporting on Turla’s STOCKSTAY operations, although those attacks involved a different backdoor.

The email collection component, CerealBox, runs inside EdgeTransport.exe, which handles Exchange mail flow. Rather than register a new transport agent, it wraps handlers belonging to existing agents in memory.

Its code examines messages before returning control to the original handlers. Mail delivery continues, while Exchange’s configuration does not show a newly installed agent.

ESET describes this approach to hooking the transport pipeline as previously undocumented in malware. Collection follows specific rules. A message must contain a .doc, .docx, or .pdf attachment and match configured sender, recipient, subject, or attachment-name criteria, while avoiding ignore lists.

Selected messages are compressed, encrypted, and stored on disk. Operators then retrieve and delete the staged files using other Cereal commands.

The design separates continuous email monitoring from later data removal, allowing the attackers to choose when they collect the results.

CerealLoader uses native entry points and VTable Fixups to reach malicious .NET code through execution paths that managed-code inspection can miss. Operators also planted loaders in the .NET native image cache and used DLL search-order hijacking.

Together, these techniques show why checking only transport-agent settings or outbound connections would leave important parts of this intrusion unseen during an investigation of compromised Exchange infrastructure and its surrounding Windows systems.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Turla Hackers Use Cereal Malware Toolset to Exploit Microsoft Exchange Servers for Email Theft appeared first on Cyber Security News.