Turla Cereal Malware Exchange Servers Explained: How Russia-Linked Hackers Spied on NATO and EU Emails

Illustrative image: a data centre server room. Image: Wikimedia Commons / BalticServers.com, GFDL

TL;DR: Turla Cereal malware Exchange servers explained — ESET disclosed on 10 November 2026 that the Russia-aligned Turla group used the eight-part Cereal toolset to quietly copy selected government emails, in Romania messages to and from NATO and the EU, while the mail itself kept flowing normally. There is no single patch for Cereal; the defence is patched Exchange servers, endpoint monitoring and ESET's published indicators of compromise.

Key Highlights

• What: Cereal, a modular .NET espionage toolset that runs on compromised Microsoft Exchange servers, disclosed by ESET Research on 10 November 2026.
• Who: Attributed with high confidence to Turla, a Russia-aligned APT group active since at least 2004 and widely assessed to be part of Russia's FSB.
• Victims: Two governmental organisations — one in Kazakhstan, detected 28 November 2025, and one in Romania, compromised from 23 December 2025.
• The target: In Romania, Cereal was configured to collect emails sent to or received from NATO (nato.int) and EU (europa.eu) addresses.
• The twist: No attacker-controlled command server was found. The victims' own Exchange servers were co-opted to act as the command-and-control infrastructure.

What happened?

ESET Research published its findings on 10 November 2026 in a blog post and white paper titled "Exchange for breakfast: Turla's Cereal tricks are not for kids". The researchers had found the toolset on an Exchange server belonging to a governmental organisation in Kazakhstan on 28 November 2025. After improving their detection rules, they found the same toolset at a governmental organisation in Romania, compromised from 23 December 2025. Activity in Kazakhstan surged on 15 January 2026; in Romania it picked up from 20 January 2026.

The name "Cereal" comes from serialization — the technique of packaging data and code for transport — which the toolset relies on heavily. ESET attributes Cereal to Turla with high confidence, based on its use alongside a component previously linked to the group and similarities to older Turla malware. Turla, also known as Snake and Secret Blizzard, has targeted governments, diplomatic missions and defence organisations across Europe, Central Asia and the Middle East for more than two decades. ESET notes that around 70% of the countries Turla has targeted since 2022 have been former Soviet republics or European countries once closely aligned with the Soviet Union.

One thing ESET could not determine is how the attackers first got in. The white paper states the initial access method is unknown, and that, given the Exchange servers are accessible from the internet, it is possible they were breached by exploiting a vulnerability — but that is a possibility, not a confirmed entry route.

Turla Cereal malware Exchange servers explained: how the eight components work

Cereal is not one program but eight tightly connected components, most of them .NET assemblies that are decrypted, loaded into memory and executed by other components — almost nothing is written to disk. The table below is ESET's own breakdown.

Component	What it does
CerealLoader	The only component written to disk as a recognisable .NET file. Loads and runs a .NET assembly from an encrypted file, abusing rarely used .NET features (VTable Fixups) to run native code before the .NET runtime starts.
CerealRunner	Carries other encrypted .NET programs and delivers commands — each command is its own small compiled program, sent as a disposable executable.
CerealSprinter	Similar to CerealRunner, but used only to load and run other components.
CerealNeuron	The passive backdoor. Instead of calling home, it waits for incoming web requests on paths that look like ordinary Exchange traffic (/owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/) and runs the commands they carry. Wrong requests get redirected to a legitimate-looking Exchange error page.
CerealHermit	A variant of CerealNeuron with no network functions; it reads commands from encrypted files on disk instead.
CerealIron	An injector that loads and runs .NET assemblies from non-.NET processes.
CerealBox	The email-collection module. It injects itself into EdgeTransport.exe — the Exchange process that handles mail flow — and wraps the handlers of transport agents already loaded in memory, so no new agent appears in Exchange's configuration. It copies messages with .doc, .docx or .pdf attachments that match sender, recipient, subject or attachment-name lists, then compresses, encrypts and stages them for later exfiltration.
CerealMoth	A simple component that receives an assembly and a method name, loads the assembly and runs the specified method.

The commands operators sent through CerealNeuron included retrieving mailboxes via Exchange Web Services, querying Active Directory for users, groups and DNS records, running WMI queries, extracting locally stored Windows credentials (LSA Secrets), listing volume snapshots, and reading or deleting files — often the staged email dumps CerealBox had produced.

What makes Cereal stand out, in ESET's assessment, is the depth of .NET tradecraft: CerealLoader hid inside legitimate Windows components (posing as ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\) and abused the .NET native image cache, planting malicious files with names such as Microsoft.Exchange.Search.Mdb.ni.dll so Exchange itself loaded them. ESET calls the in-memory interception of Exchange's transport pipeline a novel technique, not previously documented for any malware family. Turla has used Exchange as an operational hub before — its LightNeuron backdoor, analysed in 2019, delivered commands hidden in email attachments — but Cereal takes the idea much further.

Why the Romania case matters most

Illustrative image: the new NATO headquarters in Brussels. The Romanian case targeted NATO and EU correspondence. Image: Wikimedia Commons / Swadim, CC BY-SA 4.0

In Romania, CerealBox was configured to collect messages involving NATO and EU institutional addresses. ESET notes the focus fits long-standing Russian intelligence priorities, and that it may relate to regional tensions: since early 2025, Romania has reported several incidents of Russian drones crashing near or within its territory. In Kazakhstan, ESET notes the compromise occurred as the country reportedly began deporting some Russian exiles and regime critics in January 2026 — people whose details Kazakh authorities would hold. Neither victim organisation has been named by ESET.

For readers outside those two countries, the lesson is structural, not personal: Exchange servers sit at the centre of government and corporate communications, and a toolset that lives inside the mail pipeline — copying selected messages while delivery continues normally — is far harder to spot than one that breaks things. ESET named only Kazakhstan and Romania as victims; there is no evidence in the research of Indian organisations being affected.

What Exchange admins and users should do now

Cereal is a post-compromise toolset, not a single vulnerability, so there is no one patch that removes it. ESET has published a comprehensive list of indicators of compromise (IoCs) in its GitHub repository and white paper. Practical steps from the research:

• Patch Exchange and keep it patched. The initial entry route is unconfirmed, but the servers were internet-facing, and exploiting an Exchange vulnerability is the possibility ESET raises. Our Microsoft November 2026 Patch Tuesday Outlook zero-day explainer covers the current round of Exchange-adjacent fixes.
• Check for the known traces. Look for unexpected DLLs in C:\Windows\System32\wbem\, suspicious entries in the .NET native image cache, and web requests to the three listener paths CerealNeuron used.
• Review transport agents. CerealBox leaves no new agent in Exchange's configuration, so check for injected code in EdgeTransport.exe behaviour and unexpected staged files rather than a configuration change.
• Use endpoint detection. Because Cereal runs almost entirely in memory, disk scans alone will miss it; EDR telemetry on Exchange servers is the realistic detection route.
• For everyday users, nothing changes. Cereal targets government Exchange servers, not personal inboxes. The advice that does carry over: keep your mail apps updated — the same week also brought the CERT-In Chrome warning and the actively exploited Check Point CVE-2026-123039 flaw, both worth patching.

Should you care?

Verdict: If you run or administer a Microsoft Exchange server, yes — read ESET's white paper, check the IoCs, and make sure your server is patched and monitored. If you are an everyday email user, this is a story to understand rather than a threat to act on: Cereal went after two governments' servers, not personal accounts. Its real significance is the technique — an attacker that turns your own mail server into its control room is much harder to find than one that phones home.

FAQs

What is Cereal malware?

Cereal is ESET's name for a modular .NET espionage toolset that runs on compromised Microsoft Exchange servers. Its eight components provide passive access, execute task-specific code in memory, and selectively collect email messages — in the observed cases, government correspondence involving NATO and the EU.

How does Cereal malware work?

After an Exchange server is compromised — by a route ESET could not determine — CerealLoader starts the chain from disk, other components run encrypted .NET code in memory, the CerealNeuron backdoor waits for operator commands disguised as ordinary Exchange web traffic, and CerealBox injects itself into the mail transport process to copy selected messages while normal delivery continues.

Who is the Turla hacker group?

Turla, also known as Snake and Secret Blizzard, is a Russia-aligned advanced persistent threat group active since at least 2004 and widely assessed to be part of Russia's Federal Security Service (FSB). It mainly targets governments, diplomatic missions and defence organisations in Europe, Central Asia and the Middle East, and is known for breaching the US Department of Defense in 2008 and the Swiss defence company RUAG in 2014.

Is my email at risk from Cereal?

For personal accounts, there is no evidence of risk: ESET observed Cereal only on two government Exchange servers, in Kazakhstan and Romania. The risk applies to organisations running internet-facing Exchange servers, which should apply the latest patches, monitor with endpoint detection, and check ESET's published indicators of compromise.

Takeaway

Cereal shows how far state-linked espionage has moved beyond the smash-and-grab breach: eight small components, almost nothing on disk, no command server to block — just the victim's own mail server, quietly doing the attacker's work. The defence is equally unglamorous: patch Exchange, watch it properly, and check the IoCs.

For the full technical detail, including the complete indicator list, read ESET's white paper linked in the Sources below — and if your organisation runs Exchange, share this with the person who looks after it.

Sources

ESET — ESET Research: Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails (10 November 2026)
ESET WeLiveSecurity — Exchange for breakfast: Turla's Cereal tricks are not for kids (10 November 2026)
ESET Research white paper — Exchange for breakfast: Turla's Cereal tricks are not for kids (PDF, 10 November 2026)
BleepingComputer — Turla hackers use new Cereal malware to spy on govt Exchange servers (10 November 2026)
Security Affairs — Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room (10 November 2026)