Cereal malware has enabled Russian state-backed hackers to intercept emails on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. Researchers identified the toolset in late 2025 and detailed its role in a Turla espionage campaign on November 10.
The investigation first uncovered the modular .NET malware at a government body in Kazakhstan. A month later, researchers found it at a Romanian government agency, where attackers selectively collected correspondence involving NATO and European Union representatives.
Turla selectively collects sensitive correspondence
Turla, also known as Snake, Secret Blizzard and Waterbug, has conducted cyberespionage operations for more than two decades. Researchers link the group to Russia’s Federal Security Service, the FSB.
The Romanian organization suffered a compromise on December 23, 2025. In that environment, the attackers configured their tools to collect messages matching specific sender, recipient and subject criteria.
They also targeted emails carrying document attachments, including DOC, DOCX and PDF files. Consequently, the collection focused on selected correspondence rather than indiscriminately copying every message passing through the server.
Cereal malware hides inside normal email processing
One component, CerealBox, injects into Exchange’s EdgeTransport.exe process and takes over handlers belonging to existing transport agents. This allows it to inspect email content without registering a new agent or interrupting normal message delivery.
Meanwhile, a second component called CerealNeuron receives encrypted web requests through paths resembling legitimate Exchange services. It checks and decrypts those requests before launching the commands they contain.
The attackers package these commands inside CerealRunner programs, which carry encrypted .NET code and the arguments needed to execute it. That code runs in memory and returns its results to CerealNeuron, which encrypts the output before sending it back.
Available tasks include retrieving emails, querying Active Directory and extracting locally stored credentials. The toolset can also read or delete files and gather information about users, groups and DNS records.
Modular design supports prolonged access
Researchers found numerous nearly identical programs compiled for individual tasks. This pattern suggests that Turla uses an internal framework to automate command preparation, although that remains an analytical assessment.
Furthermore, the investigation found no separate external command-and-control infrastructure in the observed attacks. Instead, the compromised Exchange server itself acted as the operation’s control point.
Another component, CerealHermit, reads commands from encrypted files stored on disk and has no networking capabilities. It may provide a fallback when CerealNeuron’s web channel becomes unavailable, but researchers did not establish how attackers deliver those files or retrieve results.
The Cereal malware toolset also abuses the .NET native image cache to execute within legitimate processes. Combined with its small disk footprint and in-memory execution, these techniques support sustained surveillance while limiting visible signs of compromise.
Researchers assess that the platform serves long-term, covert cyberespionage. They have also published indicators of compromise to help defenders investigate potentially affected environments.
0 responses to “Cereal malware targets government Exchange servers”