Inside Turla Cereal: Exchange as an Espionage Hub

Turla Cereal is a modular espionage toolset built to operate inside compromised Microsoft Exchange servers. ESET attributes it to Turla with high confidence, based on linked tooling and conceptual similarities to earlier malware.

ESET found Cereal at two public-sector organizations in late 2025. The toolset made Exchange both an internal execution hub and a selective email collection point, while avoiding dedicated external command infrastructure.

What Makes Turla Cereal Different?

ESET describes Cereal as tightly connected .NET components rather than one large implant. Different modules load encrypted content, execute task-specific assemblies, provide passive access, inject code, and filter email.

This design reduces dependence on a recognizable command set or regular outbound beacon. Operators can deliver a small program for each task and return its output through the same modular chain.

The research observed no dedicated external command infrastructure. A passive backdoor waited on the compromised Exchange server, making the victim’s internet-facing system the operator-accessible control point.

This architecture can make network-only detection less decisive. Legitimate Exchange services and malicious access share the same server, while command execution can remain inside memory after encrypted content is unpacked.

1. 1Compromised Exchange serverSpecialized components establish concealed execution
2. 2Passive accessThe server waits for operator-delivered tasks
3. 3In-memory task executionModular .NET programs map systems and retrieve data
4. 4Transport-process injectionCerealBox reaches Exchange mail flow
5. 5Selective collectionMatching messages are encrypted and staged
6. 6Operator retrievalOther Cereal components collect and remove staged data

How Does the Turla Cereal Chain Run?

The chain begins after an Exchange server is already compromised. ESET’s report does not establish the initial-access method, so defenders should not treat one entry vector as proven for these cases.

CerealLoader starts encrypted .NET content through unusual execution paths. ESET says it can run native code before normal managed execution, obscuring the malicious method from an analyst who inspects only the expected .NET entry point.

The research also describes abuse of legitimate Windows loading behavior and the .NET native image cache. These routes let malicious code activate while the surrounding Windows or Exchange function continues to work.

Next, runner components unpack encrypted assemblies and execute them in memory. ESET observed task-specific programs for mailbox access, directory mapping, system queries, local secret access, and file operations.

The volume of similarly structured task binaries led ESET to suggest an internal framework for compilation and delivery. That is the researcher’s assessment, not confirmation of a recovered operator development system.

Why Does Passive Exchange Access Change Detection?

Many backdoors initiate outbound connections that defenders can cluster around unfamiliar infrastructure. CerealNeuron instead receives operator requests at the compromised server and executes delivered assemblies after its checks succeed.

ESET could not identify the operators’ ingress addresses. The observed design therefore shifts attention from a known external controller toward anomalies on the Exchange host and its normal web-facing services.

A second component offers an offline route through encrypted command files. ESET observed both access methods in some intrusions, which means removing one communication path may not remove the operator’s other route.

The discussion signal supports continued monitoring of Turla-related reporting, but it does not confirm deployment of Cereal. ESET’s technical observations remain the evidence for the toolset and the two reported compromises.

How Does CerealBox Collect Selected Email?

CerealBox reaches the Exchange transport process through a nested delivery chain. Instead of registering a new transport agent, it wraps handlers that are already loaded in memory.

Its logic runs before control returns to the legitimate handler, allowing normal email delivery to continue. ESET says this avoids adding a visible agent to Exchange configuration and requires deep knowledge of the mail pipeline.

The module evaluates messages against hardcoded selection and ignore criteria. It can consider senders, recipients, subject text, attachment names, and selected document attachment types before staging a copy.

Matched messages are compressed, encrypted, and written for later retrieval. Other Cereal tasks can collect and delete those staged files, separating continuous mail inspection from operator-controlled exfiltration.

This makes a healthy-looking mail flow weak reassurance on its own. In the observed model, delivery continues while an injected handler quietly evaluates and copies selected communications.

Where Can Defenders Break the Chain?

Begin with Exchange processes that load unexpected code or show unexplained in-memory assemblies. Compare process modules, service-loading history, and native image cache integrity against a known-good server baseline.

Correlate those findings with mail transport behavior and endpoint telemetry. A new transport agent is not required in ESET’s observed chain, so configuration review alone cannot exclude malicious mail-flow hooks.

Review evidence for encrypted staging, unusual access to mailboxes, and task-driven directory or system discovery. Preserve volatile evidence before restarting services because important execution stages may exist only in memory.

Examine identity activity and local secret exposure around the same period. ESET observed Cereal tasks that could query directory data and access locally stored secrets, broadening the investigation beyond Exchange content.

1. Preserve volatile evidenceCapture process, module, connection, and relevant memory evidence before disruptive containment.
2. Validate Exchange process integrityCompare loaded components and service behavior with a trusted baseline.
3. Correlate the mail pipelineReview transport telemetry, mailbox access, and unexplained message staging together.
4. Scope identity activityInvestigate directory discovery, privileged access, and possible local-secret exposure.
5. Contain every access routeAddress both network-receiving and file-driven execution paths found in the environment.
6. Rebuild trustRecover from known-good media and rotate credentials whose exposure cannot be excluded.

These steps are Brandefense defensive guidance derived from ESET’s observed chain. Organizations should adapt collection and recovery to their Exchange architecture, evidence-retention policy, and incident response plan.

What Does the Attribution Show?

ESET attributes Cereal to the Russia-aligned group Turla with high confidence. Its basis includes concurrent use of a component publicly linked to Turla and conceptual similarities with older Turla malware.

High confidence is still an attributed research judgment, not direct proof of a government order. The finding should remain attached to ESET when analysts brief leadership or enrich a Turla threat profile.

ESET identified two public-sector organizations affected by Cereal. This article withholds their names and detailed geopolitical context, while retaining the reported sector and the selective intelligence-collection purpose.

For broader background, see our Turla APT analysis. Teams operationalizing actor reporting can also use a threat intelligence platform to connect attributed behaviors with internal telemetry.

What Remains Unknown About the Campaign?

ESET’s opened report does not establish how the two Exchange servers were first compromised. It also does not identify the operator ingress addresses used with the passive access channel.

The report documents observed components and behaviors, but it does not make every Cereal deployment visible. Defenders should use its chain as a hunting model while keeping conclusions tied to evidence from their own environment.

The central lesson is architectural. Cereal turns a trusted communications server into the place where access, execution, collection, and operator control converge.

That convergence calls for joined-up detection across endpoint, Exchange, identity, and mail telemetry. Watching only outbound infrastructure or registered transport agents leaves major parts of the observed chain outside view.