SOC, XDR, and Threat Intelligence

Turla and the Cereal toolset: Exchange server backdoor copies government emails without dedicated infrastructure

On November 10, 2026, ESET published an analysis of a .NET toolset dubbed Cereal, attributed with high confidence to the Russia-aligned Turla group. The tools operated on Microsoft Exchange servers at two government institutions in Kazakhstan and Romania, copying selected messages from the mail flow.

  • SourceESET
  • Source publicationNovember 10, 2026
  • TypeThreats and incidents

What happened

ESET discovered Cereal on November 28, 2025, on an Exchange server of a Kazakh government institution. A Romanian institution was compromised on December 23, 2025. Researchers have not determined the initial entry vector.

C2-less command and control. The primary backdoor, CerealNeuron, does not connect to any external infrastructure. It listens on the Exchange server itself using paths mimicking legitimate ones, such as /owa/sdds/ and /autodiscover/proxyservice/. A correctly encrypted request is executed as a command; any other request receives a standard Exchange error page. ESET was unable to identify the operators’ IP addresses.

Email collection. The CerealBox module injects into the EdgeTransport.exe process (the Exchange transport service). It intercepts messages with .doc, .docx, or .pdf attachments that match predefined lists of senders, recipients, subjects, or filenames. Copies are compressed, encrypted, and stored on disk for later retrieval. In Romania, the module was configured to target correspondence with NATO and EU institutional addresses.

Key findings

  • Eight components, including CerealLoader, CerealNeuron, CerealHermit (a network-less variant executing commands from local files), and CerealBox.
  • The loader masquerades as ncobjapi.dll and wbemcomn.dll in the C:\Windows\System32\wbem\ directory.
  • Malicious files were also placed in the .NET native image cache, e.g., as Microsoft.Exchange.Search.Mdb.ni.dll.
  • Attribution: Turla, with high confidence, based, among other things, on the use of a component previously publicly linked to the group.
  • ESET has released indicators of compromise (IoCs) in its GitHub repository.

Why it matters

SafeWave CommentaryThis operation bypasses two common detection points. There are no connections to a C2 server, rendering blocklists and outbound traffic analysis ineffective. Furthermore, no new transport agent is installed, as the module hooks into existing ones. Detection relies on server-side activity. For those maintaining on-premises Exchange: compare the contents of the wbem directory and .NET native image cache with ESET’s indicators; cover the Exchange server with EDR monitoring in the same way as admin workstations; review IIS logs for requests to unusual paths under /owa/, /autodiscover/, and /microsoft-server-activesync/; identify personnel corresponding with EU and NATO institutions and treat those mailboxes as high-risk targets. Institutions and companies in Poland that maintain such correspondence fit the victim profile described by ESET. More: SOC, XDR, and Threat Intelligence.