Turla's Cereal toolset turns a compromised on-premises Exchange server into the command channel and mail collector at Kazakh and Romanian government bodies, with no attacker infrastructure and no new transport agent registered (ESET)
ESET: Turla's Cereal runs the victim's own Exchange server as C2 and wraps transport agents to collect mail
Defender actions
- On every internet-facing Exchange server, compare ncobjapi.dll and wbemcomn.dll in C:\\Windows\\System32\\wbem\\ and the Microsoft.Exchange .ni.dll files in the .NET native image cache with the Microsoft originals and list the non-Microsoft assemblies loaded into EdgeTransport.exe, because ESET places the Cereal loader at those locations and Get-TransportAgent shows nothing new.
Analysis
ESET found a previously undocumented .NET toolset, Cereal, on a Kazakh government organisation's Exchange server on 2025-11-28 and, after tuning its detections, on a Romanian government organisation's Exchange server compromised from 2025-12-23; in Romania the mail-collection module was configured to identify messages to or from NATO and EU institutional addresses (ESET Research, 2026-11-10). ESET attributes Cereal to Turla with high confidence, on the concurrent use of another component publicly linked to Turla and conceptual similarity to older Turla malware, and could not determine the initial access method, although it considers a vulnerability exploit possible because the servers are reachable from the internet (ESET Research, 2026-11-10).
The command channel is the victim's own Exchange server. CerealNeuron runs on the compromised server and passively waits for requests on web paths made to look like Outlook Web Access, Autodiscover and ActiveSync traffic; a correctly encrypted request is treated as a command and a bad one gets a normal-looking Exchange error page, and ESET found no operator-controlled server and could not identify ingress addresses (ESET Research, 2026-11-10). CerealHermit is a network-less variant that reads encrypted command files from disk, and each task runs as a small .NET assembly inside a CerealRunner (mailbox retrieval, Active Directory and WMI queries, LSA secrets extraction, file operations) (ESET Research, 2026-11-10). CerealLoader, the only component written to disk in recognisable .NET form, abuses .NET VTable fixups so native code runs before managed code and is placed where trusted processes load it: the System32 wbem directory (ncobjapi.dll, wbemcomn.dll, loaded by WMI) and the .NET native image cache (ESET Research, 2026-11-10). CerealBox, injected into EdgeTransport.exe, wraps the handlers of transport agents already loaded, so "no new agent appears anywhere in Exchange's configuration"; it keeps messages with .doc, .docx or .pdf attachments that match hard-coded sender, recipient, subject or attachment-name lists and stages them compressed and encrypted on disk for exfiltration through CerealNeuron (ESET Research, 2026-11-10).
Triage: third-party anti-spam, data-loss-prevention and archiving products also inject into the transport service, but they are vendor-signed and appear in the transport-agent configuration, which CerealBox does not; the native image cache regenerates legitimately after .NET updates, so a changed timestamp alone is weak, while a file that does not match the Microsoft binary is the signal.
Cited evidence
Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.
We attribute Cereal, with high confidence, to the Russia-aligned APT group Turla, based on the concurrent use of another component publicly linked to Turla and conceptual similarities to older Turla malware.
Once inside, CerealBox accesses Exchange’s internal structures, finds the existing transport agents, and wraps their handlers with malicious code.
No new agent appears anywhere in Exchange’s configuration.
it was configured to identify emails sent to, or received from, The North Atlantic Treaty Organization (NATO) and European Union (EU).
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.