Attackers used a previously undocumented toolset called Cereal to collect government email from Microsoft Exchange servers in Kazakhstan and Romania, including Romanian correspondence involving NATO and EU addresses. ESET Research disclosed the findings on November 10, attributing Cereal to the Russia-aligned espionage group Turla with high confidence.
ESET identified two compromised national government organizations. The toolset operates inside already compromised Exchange environments, combining selective email collection with credential extraction and internal reconnaissance. A passive backdoor turns the victim’s internet-facing Exchange server into the operators’ control point; ESET observed no external command-and-control infrastructure.
The researchers first found Cereal at a Kazakh government organization on November 28, 2025. After refining their detections, they identified it at a Romanian government organization compromised on December 23, 2025. In Romania, the email collection component was configured to target messages sent to or received from NATO and EU institutional addresses.
Exchange becomes the control point
CerealNeuron, the toolset’s main backdoor, waits for incoming web requests instead of periodically contacting an attacker-controlled server. ESET observed it listening on paths resembling ordinary Exchange services:
https://*:443/owa/sdds/HTTPS://*:443/AUTODISCOVER/PROXYSERVICE/HTTPS://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/
When a request passes integrity checks, CerealNeuron decrypts its contents and executes the enclosed command program. Requests that fail validation are redirected to a legitimate-looking Exchange error page. This places malicious communications alongside Outlook Web Access, Autodiscover and ActiveSync traffic, limiting opportunities to identify and block separate attacker infrastructure.
ESET could not identify the operators’ ingress IP addresses. The researchers said connections could have arrived directly, through anonymization services or through other compromised hosts.
A second backdoor, CerealHermit, removes the network functionality. It reads encrypted command files from disk and writes encrypted results back. Both backdoors were deployed together in some intrusions, providing independent execution channels. BleepingComputer’s report described Hermit as a possible fallback if Neuron’s web channel became unavailable.
Small programs deliver individual commands
CerealNeuron has no built-in command catalogue. Operators instead deliver individual tasks as compiled .NET programs wrapped in CerealRunner, which carries encrypted binaries and their execution arguments. The payloads run in memory and return their output through CerealNeuron, which encrypts the results before sending them back.
ESET found numerous similarly structured CerealRunner binaries across the two intrusions. Their tasks included retrieving mailboxes or individual messages through Exchange Web Services; querying Active Directory for computers, users, groups and DNS records; and running WMI queries to enumerate processes or active TCP connections.
Other commands extracted locally stored credentials through LSA Secrets, listed volume snapshots, and listed, read or deleted files. File operations often involved email dumps staged by CerealBox. The volume of near-identical, task-specific binaries strongly suggests an internal framework for compiling and packaging commands, ESET assessed.
Several supporting components connect this execution chain. CerealLoader loads a .NET assembly from an encrypted disk file. CerealSprinter resembles CerealRunner but only loads and runs other components. CerealIron enables .NET assemblies to execute inside non-.NET processes, while CerealMoth loads an assembly supplied as an argument and invokes a specified method.
Collecting mail without interrupting delivery
CerealBox performs the automated email collection. Injected into Exchange’s EdgeTransport.exe process, it hijacks existing transport-agent handlers to inspect messages without registering a new transport agent or disrupting normal delivery.
The operators configured it to select messages using sender, recipient and subject criteria, including messages with .DOC, .DOCX and .PDF attachments. This lets the collection module set aside selected correspondence while the original messages continue through Exchange.
The surrounding toolset minimizes recognizable files on disk. CerealLoader is the only component stored as a recognizable, unencrypted .NET file; the others arrive in encrypted containers, are unpacked at runtime and execute from memory. ESET described the design as intended for long-term, concealed cyberespionage.
CerealLoader also complicates analysis. It uses the .NET specification’s Vtable Fixups feature to execute native code before ordinary .NET instructions begin, then bridge into a .NET method that appears unreferenced. A decompiler can therefore show an apparently inactive entry point while the payload has already executed.
In one execution chain, the loader appeared as ncobjapi.dll under C:\Windows\System32\wbem\, where the Windows Management Instrumentation service loaded it automatically. Another chain used wbemcomn.dll in the same directory. The malicious DLL forwards legitimate function calls so the host process continues working.
Operators also placed malicious loaders in the .NET native image cache under names such as Microsoft.Exchange.Search.Mdb.ni.dll. When Exchange requested the corresponding library, the runtime loaded the malicious cached file and executed its native entry point before falling back to the genuine library for normal functionality. One sample activated only when its parent process was Exchange’s search service.
Attribution and investigative leads
ESET based its high-confidence Turla attribution on the concurrent use of another component publicly linked to the group and conceptual similarities with older Turla malware. CerealNeuron’s name references Neuron, a functionally similar family attributed to Turla by the UK National Cyber Security Centre in 2017.
Turla, also called Snake, Secret Blizzard and Waterbug, has operated since at least 2004 and is widely assessed to belong to Russia’s Federal Security Service. It commonly targets governments, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East. ESET telemetry indicates that around 70% of countries targeted by Turla since 2022 were former Soviet republics or European countries formerly closely aligned with the Soviet Union. ESET also reported cooperation between Turla and Gamaredon in 2025.
The researchers placed the Romanian targeting against a backdrop of reported Russian drone incidents and calls for a NATO Black Sea mission. They suggested the Kazakh intrusion could provide visibility into Russian dissidents amid reported deportations beginning in January 2026. Those are ESET’s contextual interpretations; it also recorded a surge in Kazakh activity on January 15, 2026, immediately after the Old New Year holiday.
For Exchange defenders, the findings provide concrete investigative leads in incoming web requests, transport-process injection, unusual DLLs in the WMI directory and malicious native-image-cache entries. ESET has published a comprehensive indicator list in its GitHub repository and Turla white paper for use in investigations.
