"The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," the Slovakian cybersecurity company ESET warned, after uncovering a previously undocumented framework that lets the Russia-aligned threat actor Turla (aka Snake) turn Microsoft Exchange servers into covert email-harvesting platforms.
The actor and the victims
ESET reported that Turla used the new toolset, dubbed "Cereal," in operations observed against two governmental entities — one in Kazakhstan and one in Romania — in late 2025. In the Romanian incident, CerealBox, the malware’s email-harvesting module, was configured to gather messages involving NATO and European Union institutional addresses, a pattern ESET said aligns with Russia's strategic priorities.
The Cereal framework: eight interoperating components
Cereal is modular and designed to run entirely on compromised Exchange servers, avoiding the external command-and-control infrastructure typical of many malware families. ESET mapped eight named components that operate together:
- CerealRunner: deployed by the operator to drop other components and to unpack and execute commands.
- CerealLoader: loads and runs a .NET assembly from an encrypted file on disk and launches CerealSprinter.
- CerealSprinter: decrypts and runs CerealNeuron, CerealHermit, and CerealBox.
- CerealIron: an injector that enables loading and running .NET assemblies from non-.NET processes.
- CerealMoth: accepts an assembly plus a method name, loads the assembly, and runs the method.
- CerealNeuron: a passive backdoor that listens for incoming web requests on paths that resemble regular Exchange traffic and executes assemblies contained in CerealRunner binaries.
- CerealHermit: a networkless variant that reads commands from encrypted files on disk.
- CerealBox: the email-harvesting module that injects into the Exchange transport service ("EdgeTransport.exe") to process, filter, and collect email messages.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow Cereal operates inside Exchange
Rather than rely on external infrastructure, Cereal abuses the compromised Exchange server itself as a C2 relay and execution environment. Operators send commands as separate, compiled .NET programs; CerealRunner unpacks and runs those payloads in memory and forwards results to CerealNeuron for encrypted exfiltration. CerealIron and CerealMoth enable in-memory execution and method invocation across process boundaries, while CerealHermit can run from encrypted files on disk without network traffic.
CerealBox is engineered to manipulate the email transport pipeline. It looks for messages with DOC, DOCX, or PDF attachments and compares sender and recipient addresses, subject lines, or attachment names against multiple hard-coded lists. Messages that match are compressed, encrypted, staged to files on disk, and then exfiltrated and deleted via CerealNeuron commands.
Technical tradecraft that stands out
ESET highlighted several features that make Cereal distinct: minimal on-disk footprint, the avoidance of discoverable external infrastructure, execution that blends into legitimate Exchange processes, and the use of compiled, task-specific binaries rather than monolithic scripts. "The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands," ESET researcher Matías Porolli said. Combined with a modular, interchangeable codebase, ESET concluded the platform appears "mature" and "well-engineered."
What this means for security teams, policymakers, and affected governments
- Security teams: Expect detection challenges. Cereal leaves little on disk, injects into Exchange processes (including EdgeTransport.exe), and mimics normal Exchange traffic paths; defenders will need to look for anomalous assemblies, unusual web-request handling on Exchange paths, and encrypted staged files.
- Policymakers and strategic planners: The Romanian configuration’s focus on NATO and EU addresses underscores the intelligence value Turla places on exchanges involving multilateral institutions and aligns with stated strategic priorities identified by ESET.
- Affected governments: ESET’s findings are limited to two observed compromises in late 2025; organizations running on-premises Exchange infrastructure should assume that Exchange servers can be treated by sophisticated operators as long-term collection points unless proven otherwise.
Cereal’s design — a self-contained, Exchange-hosted framework that runs compiled .NET commands, harvests filtered attachments, and exfiltrates via server-resident backdoors — reframes how a long-running espionage campaign can exploit a ubiquitous enterprise mail platform. ESET’s analysis paints a picture of a tailored, automated system rather than opportunistic tooling; whether the framework extends beyond the two observed victims remains the critical operational question for defenders and the agencies that rely on Exchange for sensitive communications.
Original reporting: The Hacker News (ESET analysis)
