"After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," ESET researchers say in a report today.
Cereal: a modular spying platform aimed at Exchange servers
Researchers at ESET documented a previously unseen toolset named Cereal that Turla — a threat group also tracked as Snake, Secret Blizzard, and Waterbug and linked to Russia's Federal Security Service (FSB) — has been using to intercept email on Microsoft Exchange servers at government organizations. ESET first identified modular .NET malware on an Exchange server at a government body in Kazakhstan in late 2025, and then found the same toolkit on a compromised governmental organization in Romania on December 23, 2025.
How Cereal embeds itself: CerealBox and EdgeTransport.exe
The campaign centers on a component called CerealBox, which injects into the Microsoft Exchange process EdgeTransport.exe and hijacks existing transport agents’ handlers. By executing commands in memory, the malware can inspect email content without registering a new transport agent or interrupting normal message delivery on the server — behavior designed to reduce the chance of detection during routine operations.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCommand-and-control inside the server: Neuron, Runner, and Hermit
Cereal uses multiple cooperating components to receive, execute, and return results for attacker-supplied tasks. CerealNeuron listens for incoming encrypted web requests on URL paths that resemble legitimate Exchange services; those requests carry encrypted commands. After decrypting a request, Neuron executes a wrapper called CerealRunner, which contains encrypted .NET programs and their arguments. The runner executes code entirely in host memory, returns output to CerealNeuron, and Neuron then encrypts and transmits the results back to the operators.
ESET observed no external command-and-control infrastructure in use; instead, the compromised Exchange server functioned as the attackers’ sole control point. The researchers also uncovered a variant labeled CerealHermit that lacks network capabilities and reads commands from encrypted files on disk — a possible fallback or redundancy mechanism. ESET noted that it did not observe or explain how attackers place Hermit’s command files on the server or retrieve Hermit’s execution results.
What the attackers can do: targeted collection and directory reconnaissance
The Cereal toolset is configured for selective data collection. In the cases ESET analyzed, operators instructed the malware to collect messages that matched sender, recipient, and subject criteria and that contained document attachments with extensions such as .DOC, .DOCX, and .PDF. Beyond email exfiltration, CerealRunner-programmed commands may retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, read arbitrary files, or delete files.
Operational tradecraft: disposable binaries, .NET evasion, and long-term stealth
ESET highlighted a number of engineering and concealment features that point to a mature platform rather than ad hoc scripting. The company observed a “sheer volume of near-identical binaries, each compiled for a specific task,” which suggests an internal framework that automates compilation and packaging of commands. Cereal’s authors also demonstrated advanced .NET execution techniques, including abuse of the .NET native image cache, allowing code to run inside legitimate processes with a small disk footprint.
These design choices — modular interchangeable components, execution-in-memory, reuse of legitimate service paths, and minimal on-disk artifacts — are consistent with a capability built for long-term, stealthy cyberespionage and for relying on infrastructure that is less likely to be blocked or discovered by conventional network monitoring.
What this means for government Exchange administrators, cybersecurity teams, and policymakers
- Government Exchange administrators: Should be aware that an attacker-controlled Exchange server can be used as the exclusive control point for espionage tooling, and that transport-agent hijacking can inspect messages without adding new, easily-detected agents.
- Cybersecurity teams and incident responders: Need to consider memory-resident .NET components and fileless execution paths, as ESET observed CerealRunner programs executing from memory and CerealHermit reading encrypted files on disk as an alternate command channel.
- Policymakers and network defenders overseeing government assets: The selective targeting of messages with NATO and EU recipients in the Romanian compromise underscores the geopolitical focus of the campaign and the potential for long-term surveillance of intergovernmental correspondence.
ESET has published an extended list of indicators of compromise on its GitHub page, and its report provides the technical detail underlying these findings. The analysis documents a carefully engineered espionage platform that leverages Exchange internals for stealth and persistence, and that in the cases ESET examined was deployed against government networks in Kazakhstan and Romania late in 2025.
