Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania.

ESET Research detailed a previously undocumented toolset it calls Cereal, built to run on Microsoft Exchange servers. The researchers found it on 28 November 2025 at a government body in Kazakhstan, and later at a government body in Romania, which was compromised on 23 December. The researchers discovered that in Romania, it was set up to spot emails to or from NATO and the European Union. ESET attributes it with high confidence to the Turla APT group (aka Secret Blizzard, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) that has been active since at least 2004, targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Russia-nexus actor is assessed to be affiliated with Center 16 of Russia’s Federal Security Service (FSB).

The name Cereal comes from serialization, a process that programs use to package data and code for transfer. Most of the toolset consists of modular .NET code that arrives encrypted, unpacks itself in memory and leaves almost no files on disk. Only the first loader is saved as a regular .NET file.

One unusual feature is that ESET found no attacker-controlled server. The main backdoor, CerealNeuron, doesn’t connect to an external server. Instead, it runs on the victim’s Exchange server and waits for commands through web paths that look like normal Outlook Web Access, Autodiscover and ActiveSync traffic. This makes the activity difficult to spot in firewall logs. If a request isn’t properly encrypted or fails security checks, the server simply returns a normal-looking Exchange error page.

“CerealNeuron, a passive backdoor with no built-in commands but capable of executing assemblies contained in CerealRunner binaries, received in network requests;” reads the analysis published by ESET.

“The consequences are significant:

• Malicious traffic coexists with legitimate Exchange web services – exactly the kind of traffic defenders are least likely to block.”
• There is no dedicated C&C infrastructure to discover, block, or take down. The victim’s own internet-facing Exchange server is the operator-accessible control point.
• Network-based tracking is severely limited. We were unable to identify the ingress IP addresses used by the operators. They may have connected directly, via anonymization services, or from other compromised hosts.”

As a result, defenders have no external server to block or take down. ESET couldn’t even identify the attackers’ IP addresses. A second version, called CerealHermit, has no network functions and reads encrypted command files directly from disk. This means some victims had two separate ways for attackers to access their systems.

Commands work like disposable programs. Instead of one backdoor with a built-in menu, the operators send each task as a small compiled .NET program carried by a component called CerealRunner. The tasks include pulling mailboxes through Exchange Web Services, querying Active Directory, running WMI queries, extracting locally stored Windows credentials and handling files. ESET saw so many near-identical binaries that it believes the operators run an internal system that builds them automatically.

The .NET tricks are what set this apart. The first loader abuses a rarely used feature to run native code before any .NET code, so an analyst sees an entry point that does nothing. Operators also dropped it into the Windows management folder under names like ncobjapi.dll, and into the .NET native image cache under names like Microsoft.Exchange.Search.Mdb.ni.dll, so trusted processes loaded it for them.

The email theft is the part ESET calls new. The module, CerealBox, injects itself into EdgeTransport.exe, the process that handles mail flow, and wraps the handlers of transport agents already running in memory.

“CerealBox uses a stealthier approach. Instead of registering itself, it is injected directly into EdgeTransport.exe, the Exchange process that handles email flow.” continues the report. “Reaching that point, however, is not straightforward: CerealBox is delivered through an intricate chain of nested Cereal components”

It registers no new agent, so nothing shows up in Exchange’s configuration. A message qualifies if it carries a .doc, .docx or .pdf file and matches hardcoded lists of senders, recipients, subject words or file names. Selected messages get compressed, encrypted and staged on disk, and the operators collect and delete them later.

The victims match Turla’s usual targets. According to ESET, around 70% of the countries targeted by the group since 2022 were former Soviet republics or European countries that once had close ties with Moscow. The focus on Romanian NATO and EU email systems is consistent with Russia’s long-standing intelligence interests. ESET also links the attacks in Kazakhstan to the country’s deportation of Russian exiles since January 2026. Activity in the country increased on January 15, the day after the Old New Year holiday.

Organizations running Exchange should check for suspicious activity that may not be visible in standard configurations. This includes unusual DLL files in the Windows management folder, unexpected files in the native image cache and suspicious requests to the three web paths used by the backdoor. A clean list of Exchange transport agents does not necessarily mean that the mail system is free from compromise.

“The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage.” concludes the report. “The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers – they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)