Russia-linked hackers have used a previously undocumented malware toolkit called Cereal to compromise government organizations in Romania and Kazakhstan, turning Microsoft Exchange servers into email-collection and command-execution hubs.
ESET researchers say the toolkit includes a novel interception technique that copies selected messages from inside Exchange’s mail transport pipeline. In Romania, the attackers configured it to collect correspondence involving NATO and European Union institutional addresses.
The security company first discovered Cereal at a Kazakh governmental organization on November 28, 2025. After refining its detections, it identified the same toolkit at a Romanian governmental organization compromised on December 23, 2025.
ESET attributes Cereal to Turla with high confidence, citing the concurrent use of another component publicly linked to the group and similarities to its older malware. Also known as Snake, Turla has operated since at least 2004 and is widely assessed to belong to Russia’s Federal Security Service (FSB), targeting governments, diplomatic missions, and defense organizations.
Intercepting email inside Exchange
The toolkit’s email collection module, CerealBox, is injected into EdgeTransport.exe, the Microsoft Exchange process responsible for handling mail flow.
Rather than installing a new transport agent, a legitimate extension used for functions such as spam filtering, CerealBox hijacks handlers belonging to agents already loaded in memory. Its malicious wrappers examine messages before returning control to the original code, allowing email delivery to continue normally.
This leaves no newly registered agent in Exchange’s configuration. ESET describes the technique as previously undocumented in any malware family.
CerealBox selects messages containing .doc, .docx, or .pdf attachments that also match hardcoded criteria, including sender or recipient addresses, subject text, and attachment names. Ignore lists exclude unwanted matches.
Selected emails are compressed, encrypted, and stored on disk. The operators subsequently retrieve and delete those files through other toolkit components.
Victim’s server becomes the control point
Cereal’s main backdoor, CerealNeuron, avoids the periodic outbound connections commonly used by malware to contact command-and-control servers. Instead, it waits for encrypted incoming web requests on paths resembling legitimate Exchange services, including Outlook Web Access, Autodiscover, and ActiveSync.
Requests that pass its checks deliver compiled .NET programs for execution. Invalid requests are redirected to an Exchange error page, helping conceal the backdoor.
ESET observed no external command-and-control infrastructure and could not identify the operators’ ingress IP addresses. A second backdoor, CerealHermit, provides a fallback by reading encrypted commands from disk and writing encrypted results.
The delivered programs can retrieve mailboxes and messages, query Active Directory, inspect processes and network connections, extract locally stored credentials, and manipulate files.
The toolkit also uses unusual .NET execution methods to evade analysis. Its loader can run native code before its apparent .NET entry point, impersonate Windows DLLs, and abuse the .NET native image cache to execute malicious code when Exchange loads a library.
Checking registered Exchange transport agents or looking for outbound malware connections alone would miss key elements of this toolkit. Its email collection logic operates inside existing agents, while its network backdoor receives commands through the compromised server’s own web services.
Leave a Reply