Russia's Turla espionage group has been hiding inside Microsoft Exchange servers at two national government bodies and using the victims' own mail servers as its command post, according to new research from ESET. The toolset, which ESET calls Cereal, quietly copies selected emails as they pass through, including messages to and from NATO and the European Union.
ESET found the first infection on November 28, 2025, at a governmental organization in Kazakhstan. After tuning its detections, it found the same toolset at a governmental organization in Romania that had been compromised on December 23, 2025. ESET attributes Cereal to Turla with high confidence, citing the concurrent use of another component publicly linked to the group and conceptual similarities to older Turla malware. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be part of Russia's Federal Security Service (FSB).
No attacker server to find or block
Most backdoors call home, and those calls leave domains and IP addresses that defenders can block. Cereal's main backdoor, CerealNeuron, does not. It sits on the compromised Exchange server and waits for incoming web requests on paths that look like ordinary Outlook Web Access, Autodiscover and ActiveSync traffic. If a request is properly encrypted and passes several integrity checks, it is treated as a command. If not, the visitor is redirected to a legitimate-looking Exchange error page. ESET says it could not identify the IP addresses the operators connected from.
Commands arrive as separate, small compiled .NET programs rather than from a built-in command list. ESET saw numerous near-identical binaries, each built for one task: pulling mailboxes through Exchange Web Services, querying Active Directory, running WMI queries, extracting LSA Secrets (credentials Windows stores locally), and listing, reading or deleting files. The volume strongly suggests an internal framework that automates building and packaging commands. A sibling backdoor, CerealHermit, drops the network code and reads encrypted command files from disk instead, giving the operators a second way in.
A mail filter nobody installed
The most novel piece is CerealBox. Rather than registering a visible Exchange transport agent (the plug-in feature used for jobs like spam filtering), it is injected into EdgeTransport.exe, the process that handles mail flow, and wraps the handlers of transport agents already loaded in memory. Mail keeps flowing normally and nothing new appears in Exchange's configuration. Messages with .doc, .docx or .pdf attachments that match hardcoded sender, recipient, subject or attachment-name lists are compressed, encrypted and staged on disk for the operators to collect later. In Romania it was configured to pick out NATO and EU institutional addresses. ESET says injecting into the transport service and hooking mail flow this way has not been documented for any malware family before.
The loader leans on obscure .NET features too. CerealLoader runs native code before any .NET code by abusing a rarely used feature called VTable Fixups. It was planted as ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\, where the WMI service loads it automatically, and was dropped into the .NET native image cache under names such as Microsoft.Exchange.Search.Mdb.ni.dll so that Exchange loaded it in place of the genuine library.
Hunt on the Exchange box, not the firewall
Because there is no external infrastructure, network blocklists will not catch this. Exchange administrators in government, diplomatic and defense organizations should look for the artefacts ESET describes: unexpected DLLs in the wbem folder, unfamiliar .ni.dll files in the .NET native image cache, foreign code inside EdgeTransport.exe, and requests to unusual paths such as /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/. ESET has published its full indicator list on GitHub and in a white paper linked from the report.
Turla has gone after Exchange before, and earlier this year it hit Ukraine with a stealthy new backdoor. Cereal shows how far the group will go to stay invisible. For these operators a mail server is not just a target. It is the collection point, the command post and the hiding place all at once.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.