"On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user's inbox," wrote Matias Porolli, the ESET researcher who discovered the threat.
Cereal turns Microsoft Exchange servers into long‑running collection points
Security firm ESET published research on November 10 describing a new toolset, Cereal, that operators deployed on compromised government Microsoft Exchange servers. Rather than exfiltrating data through an external command-and-control (C2) cluster, the operators co-opted each compromised Exchange server to act as its own C2 and execution hub. ESET found the toolset kept payloads encrypted, received commands as separate .NET assemblies and ran the email collection module inside Exchange's native processes, leaving little on disk to examine.
Technical tradecraft: .NET assemblies, in‑memory execution and Exchange internals
ESET’s analysis shows Cereal paired techniques that demand "a deep understanding of Exchange internals" with unusual .NET execution methods. The toolset ran modules in memory, used encrypted payloads and executed received commands as distinct .NET assemblies. One new Exchange email collection module was run inside Exchange processes to identify and harvest selected messages, according to ESET.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAttribution to Turla and assessed Russian link
ESET attributed Cereal with high confidence to the threat group Turla, also known as Snake and Uroburos. The research notes Turla has been active since at least 2004 and is "widely assessed to be part of Russia's Federal Security Service (FSB)." Based on ESET telemetry, roughly 70% of the countries Turla targeted since 2022 have been former Soviet republics or European states once closely aligned with the Soviet Union.
Victims, targeting and regional context: Romania and Kazakhstan
ESET identified two national government victims: one in Kazakhstan and one in Romania. The toolset was first observed on an Exchange server in Kazakhstan on November 28, 2025; the Romanian victim was identified roughly a month later. At the Romanian victim, Cereal was configured to pick out emails sent to or from NATO and European Union addresses. ESET said that focus aligns with long-standing Russian intelligence priorities and may also be tied to regional tensions cited in its report — for example, incidents involving Russian drones near or inside Romania since early 2025 were mentioned as contextual factors. For Kazakhstan, ESET pointed to reported deportations of some Russian exiles since January 2026 as a possible reason operators sought visibility into Russian dissidents.
What this means for technologists, policymakers, and affected governments
- Technologists and security teams: Expect a focus on detecting in‑memory .NET activity and Exchange process anomalies rather than disk artifacts. ESET’s white paper and GitHub repository include indicators of compromise that defenders can use to hunt for signs of Cereal on Exchange servers.
- Policymakers and regulators: The attribution to Turla and the toolset’s configuration to filter NATO and EU addresses at a European government underscore the geopolitical implications ESET flagged; the research links targeting choices to longstanding intelligence priorities and to specific regional tensions.
- Affected governments and incident responders: Because each compromised server was used as its own C2, defenders should treat exposed Exchange servers as potential internal command hubs and collection points. ESET’s findings that little is left on disk mean response will likely require memory analysis and targeted hunts guided by the published indicators.
Cereal, ESET concluded, was built for long‑term, stealthy cyberespionage: victims' Exchange servers became collection points and internal execution hubs while leaving minimal forensic traces on disk. The technique—running a mail‑harvesting module inside Exchange and avoiding external C2 infrastructure—raises a concrete question the findings leave in plain sight: if a compromised server can both collect and control itself, how will defenders detect and distinguish routine Exchange activity from tailored espionage that intentionally minimizes its footprint?
Original reporting: https://www.infosecurity-magazine.com/news/turla-cereal-exchange-email/
