Turla Cereal Toolset Targets Exchange Servers for Stealthy Email Harvesting in Kazakhstan, Romania
Turla’s Cereal malware provides long-term, low-footprint access to government email on compromised Exchange servers in Kazakhstan and Romania. The toolset’s in-memory execution, transport pipeline injection, and absence of external C2 reflect refined tradecraft consistent with prior Snake campaigns. Detection will require behavioral analysis of legitimate Exchange processes rather than network indicators.
Cereal consists of eight .NET components including CerealNeuron for passive backdoor listening on Exchange-like paths, CerealBox for injecting into EdgeTransport.exe to filter and stage emails with DOC or PDF attachments, and CerealIron for loading assemblies from non-.NET processes. The framework uses serialization for command delivery via compiled assemblies read from disk or web requests, leaving minimal artifacts. ESET's analysis of samples from the two victims shows hardcoded filter lists for sender, recipient, subject, and attachment names, with staged exfiltration after compression and encryption. No external infrastructure appears in the code, confirming the compromised Exchange server itself functions as the C2 hub. This matches Turla's documented pattern since the 2010s Snake operations, including prior Exchange abuse and ISP-level access in the region. Kazakhstan and Romania sit at the intersection of Russian intelligence priorities and NATO-adjacent infrastructure, suggesting collection focused on diplomatic traffic rather than immediate disruption. Defenders should prioritize behavioral monitoring of EdgeTransport.exe and anomalous .NET assembly loads on mail servers. Similar modular, fileless tooling is likely to appear against additional CIS government Exchange deployments within the next quarter.
Sources (2)
- [1]ESET Research Report(https://www.welivesecurity.com/en/eset-research/turla-cereal/)
- [2]The Hacker News Coverage(https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html)