The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that’s used to break into victims’ Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.
“The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage,” the Slovakian cybersecurity company said. “It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.”
“The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.”
The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest. The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.
Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object’s state into a format that can be easily stored, transmitted, and reconstructed.
A number of aspects make the malware stand apart –
- Absence of an external command-and-control (C2) infrastructure, instead abusing a compromised Exchange server for this purpose.
- Sending commands in the form of separate, compiled .NET programs.
- Using an automated email collection module, which is injected into legitimate Microsoft Exchange processes and is engineered to manipulate the email transport pipeline.
The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added. The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data –
- CerealRunner, which is deployed by the operator and serves as a pathway for dropping additional components, including CerealLoader, CerealSprinter, CerealIron, and CerealMoth.
- CerealLoader, which loads and runs a .NET assembly from an encrypted file on disk, leading to the execution of CerealSprinter.
- CerealSprinter, which functions similarly to CerealRunner and is used to decrypt and run CerealNeuron, CerealHermit, and CerealBox.
- CerealIron, an injector that makes it possible to load and run .NET assemblies from non .NET processes.
- CerealMoth, which receives an assembly and a method name as inputs, loads the assembly, and runs the specified method.
- CerealNeuron, a passive backdoor that runs on a compromised Exchange Server and listens for incoming web requests on paths that appear like regular Exchange traffic to execute assemblies contained in CerealRunner binaries.
- CerealHermit, a variant of CerealNeuron that reads commands from encrypted files on disk and has no network functionality of its own.
- CerealBox, which is the email harvesting module that processes, filters, and collects email messages by injecting itself into the Exchange transport service (“EdgeTransport.exe”).
Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names.
Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands.
In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia’s strategic priorities.
The commands delivered as compiled .NET programs are handled by CerealRunner, which unpacks and executes the payloads in memory and then sends the results back to CerealNeuron for subsequent exfiltration to the threat actor in encrypted format.
The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations.
“The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands,” ESET researcher Matías Porolli said.
“Combined with a codebase built around modular, interchangeable components, the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts.”
