{"id":"CMP-202611-qduyyn","kind":"campaign","aliases":[],"related":[],"title":"Russia's Turla spy group hides new Cereal malware inside Microsoft Exchange servers to steal government emails (ESET)","description":null,"summary":"ESET found Cereal, a new modular .NET toolset used by the Russia-aligned (FSB-linked) Turla group to turn Microsoft Exchange servers into long-term email collection points. Confirmed victims: a national government organization in Kazakhstan (found 28 Nov 2025) and one in Romania (compromised 23 Dec 2025), where it was set to collect mail involving NATO and EU addresses. The backdoor CerealNeuron has no external command server: it listens on the Exchange server for encrypted requests on paths that look like normal Exchange traffic (Outlook Web Access, Autodiscover, ActiveSync) and runs compiled .NET programs sent to it. CerealBox is injected into EdgeTransport.exe and hijacks transport agents already loaded in memory, so no new transport agent shows up in Exchange's configuration. It copies emails with DOC, DOCX or PDF attachments that match hardcoded sender, recipient, subject or attachment-name lists. The commands can pull mailboxes, query Active Directory, run WMI queries, extract LSA secrets and handle files. How the attackers got in: unknown. Ingress IPs: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T10:40:01+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"on-premises (version not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"On on-premises Microsoft Exchange servers, check against ESET's Cereal IoCs (in ESET's white paper and ESET's malware-ioc GitHub repo). Standard checks will miss it: there is no outbound C2 traffic and no newly registered transport agent. Look for: unexpected code injected into EdgeTransport.exe; HTTP listeners registered by processes other than Exchange's own on Exchange-like URI prefixes (OWA, Autodiscover, ActiveSync paths); tampered or unexpected precompiled images in the .NET Native Image Cache that Exchange loads instead of the originals; .NET assemblies that run native code before their managed entry point (VTable Fixups) or that pose as Windows DLLs; and encrypted or compressed staging files on the Exchange server. ESET names the components CerealRunner, CerealLoader, CerealSprinter, CerealIron, CerealMoth, CerealNeuron, CerealHermit and CerealBox.","fix":"Run ESET's published IoCs and detections across all on-premises Exchange servers. If you find a hit, treat the server and every mailbox on it as compromised: rebuild Exchange from clean media rather than cleaning it up, rotate credentials on the server and in AD (LSA secrets may have been taken), and review AD for changes. Keep Exchange fully patched. Only expose OWA, Autodiscover and ActiveSync where they are needed. Government, diplomatic and defense organizations, especially those that exchange mail with NATO or the EU, should hunt for this first.","status":"open","published_at":null,"first_seen_at":"2026-11-10T10:40:01+00:00","triaged_at":"2026-11-10T10:40:01+00:00","updated_at":"2026-11-10T10:40:35+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-10T10:41:22Z","path":"none","entry":"unknown","reason":"The record states 'How the attackers got in: unknown' and describes the compromise as confined to the victim's Exchange servers and mailboxes, with no mention of users, customers or dependents being reached through a tampered install, third-party breach, or phishing.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':20A '2025':71B,79B '23':77B '28':69B 'access':119B 'activ':180B 'activesync':121B 'address':91B 'agent':138B,147B 'align':42B 'alreadi':139B 'attach':162B,171B 'attachment-nam':170B 'attack':193B 'autodiscov':120B 'backdoor':93B 'campaign':25B 'cereal':8A,31B 'cerealbox':130B 'cerealneuron':94B 'cmp':19A 'collect':58B,85B 'command':98B,175B 'compil':124B 'compromis':76B 'configur':153B 'confirm':60B 'copi':155B 'dec':78B 'directori':181B 'doc':158B 'docx':159B 'earli':27B 'early-warn':26B 'edgetransport.exe':134B 'email':17A,57B,156B 'encrypt':107B 'eset':18A,29B 'eu':90B 'exchang':12A,51B,104B,115B,151B 'exchange':23A 'extern':97B 'extract':185B 'file':190B 'found':30B,68B 'fsb':44B 'fsb-link':43B 'got':194B 'govern':16A,64B 'group':5A,47B 'handl':189B 'hardcod':165B 'hide':6A 'hijack':136B 'ingress':197B 'inject':132B 'insid':10A 'involv':87B 'ip':198B 'kazakhstan':67B 'like':113B 'link':45B 'list':173B 'listen':101B 'load':140B 'long':55B 'long-term':54B 'look':112B 'lsa':186B 'mail':86B 'mailbox':178B 'malwar':9A 'match':164B 'memori':142B 'microsoft':11A,22A,50B 'modular':34B 'name':172B 'nation':63B 'nato':88B 'net':35B,125B 'new':7A,33B,145B 'normal':114B 'nov':70B 'one':73B 'organ':65B 'outlook':117B 'path':110B 'pdf':161B 'point':59B 'program':126B 'pull':177B 'qduyyn':21A 'queri':179B,184B 'recipi':167B 'request':108B 'romania':75B 'run':123B,182B 'russia':1A,41B 'russia-align':40B 'secret':187B 'sender':166B 'sent':127B 'server':13A,24A,52B,99B,105B 'set':83B 'show':148B 'spi':4A 'steal':15A 'subject':168B 'term':56B 'toolset':36B 'traffic':116B 'transport':137B,146B 'turla':3A,46B 'turn':49B 'unknown':196B,199B 'use':37B 'victim':61B 'warn':28B 'web':118B 'wmi':183B","nicknames":["Cereal","Turla","Snake","CerealNeuron","CerealBox","CerealLoader"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cereal","cerealbox","cerealloader","cerealneuron","exchangeserver","microsoftexchangeserver","snake","turla"],"ptokens":["exchange","microsoft","server"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"exploitation","search_a":"'-202611':20A 'cereal':8A 'cmp':19A 'email':17A 'eset':18A 'exchang':12A 'exchange':23A 'govern':16A 'group':5A 'hide':6A 'insid':10A 'malwar':9A 'microsoft':11A,22A 'new':7A 'qduyyn':21A 'russia':1A 'server':13A,24A 'spi':4A 'steal':15A 'turla':3A","search_b":"'2025':71B,79B '23':77B '28':69B 'access':119B 'activ':180B 'activesync':121B 'address':91B 'agent':138B,147B 'align':42B 'alreadi':139B 'attach':162B,171B 'attachment-nam':170B 'attack':193B 'autodiscov':120B 'backdoor':93B 'campaign':25B 'cereal':31B 'cerealbox':130B 'cerealneuron':94B 'collect':58B,85B 'command':98B,175B 'compil':124B 'compromis':76B 'configur':153B 'confirm':60B 'copi':155B 'dec':78B 'directori':181B 'doc':158B 'docx':159B 'earli':27B 'early-warn':26B 'edgetransport.exe':134B 'email':57B,156B 'encrypt':107B 'eset':29B 'eu':90B 'exchang':51B,104B,115B,151B 'extern':97B 'extract':185B 'file':190B 'found':30B,68B 'fsb':44B 'fsb-link':43B 'got':194B 'govern':64B 'group':47B 'handl':189B 'hardcod':165B 'hijack':136B 'ingress':197B 'inject':132B 'involv':87B 'ip':198B 'kazakhstan':67B 'like':113B 'link':45B 'list':173B 'listen':101B 'load':140B 'long':55B 'long-term':54B 'look':112B 'lsa':186B 'mail':86B 'mailbox':178B 'match':164B 'memori':142B 'microsoft':50B 'modular':34B 'name':172B 'nation':63B 'nato':88B 'net':35B,125B 'new':33B,145B 'normal':114B 'nov':70B 'one':73B 'organ':65B 'outlook':117B 'path':110B 'pdf':161B 'point':59B 'program':126B 'pull':177B 'queri':179B,184B 'recipi':167B 'request':108B 'romania':75B 'run':123B,182B 'russia':41B 'russia-align':40B 'secret':187B 'sender':166B 'sent':127B 'server':52B,99B,105B 'set':83B 'show':148B 'subject':168B 'term':56B 'toolset':36B 'traffic':116B 'transport':137B,146B 'turla':46B 'turn':49B 'unknown':196B,199B 'use':37B 'victim':61B 'warn':28B 'web':118B 'wmi':183B","search_c":"","cause_entry":"unknown","cause_path":"none","disclosures_checked_at":null,"first_public_at":"2026-11-08T11:39:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-qduyyn","url":"https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T10:40:01+00:00","fetched_at":"2026-11-10T10:40:01+00:00","note":null,"cites":["https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html"]}],"documents":[{"id":114330,"url":"https://x.com/ESETresearch/status/2120094134559965410","title":"@ESETresearch: #ESETresearch has uncovered Cereal, a previously undocumented modular .NET tools","kind":"post","source":"x","publisher":null,"text":"#ESETresearch has uncovered Cereal, a previously undocumented modular .NET toolset used by the Russia-aligned #Turla #APTgroup to turn victims’ Microsoft Exchange servers into stealthy long-term collection points. https://t.co/sY0oKE4QQs  1/6 https://t.co/wjhJDjc1Zt\n\nlikes 44 reposts 13","published_at":"2026-11-10T10:00:05+00:00","relation":"describes","confidence":null,"note":null},{"id":114329,"url":"https://x.com/ESETresearch/status/2120094137307263392","title":"@ESETresearch: We identified two national governmental organizations compromised by Cereal: one","kind":"post","source":"x","publisher":null,"text":"We identified two national governmental organizations compromised by Cereal: one in 🇰🇿 Kazakhstan and one in 🇷🇴 Romania. Both cases align tightly with Turla’s known targeting priorities. 2/6 https://t.co/7CdxPugI7C\n\nlikes 3 reposts 1","published_at":"2026-11-10T10:00:06+00:00","relation":"describes","confidence":null,"note":null},{"id":114328,"url":"https://x.com/ESETresearch/status/2120094138536202485","title":"@ESETresearch: The main backdoor, #CerealNeuron, is a passive implant with no external C&C.","kind":"post","source":"x","publisher":null,"text":"The main backdoor, #CerealNeuron, is a passive implant with no external C&C. It binds an HTTP listener to Exchange-like URI prefixes and passively parses inbound HTTPS requests, extracting RSA/AES-encrypted commands hidden in legitimate-looking Exchange traffic. 3/6 https://t.co/vsD6p9qDHq\n\nlikes 4 reposts 1","published_at":"2026-11-10T10:00:06+00:00","relation":"describes","confidence":null,"note":null},{"id":114327,"url":"https://x.com/ESETresearch/status/2120094140092285147","title":"@ESETresearch: The email collection module, #CerealBox, is injected into Exchange’s EdgeTranspo","kind":"post","source":"x","publisher":null,"text":"The email collection module, #CerealBox, is injected into Exchange’s EdgeTransport.exe to hijack the delegates of legitimate transport agents in memory. This avoids the on-disk footprint left by registered agents, a technique not previously documented for any malware family. 4/6\n\nlikes 4 reposts 0","published_at":"2026-11-10T10:00:07+00:00","relation":"describes","confidence":null,"note":null},{"id":114326,"url":"https://x.com/ESETresearch/status/2120094141048619129","title":"@ESETresearch: #CerealLoader, the only on-disk component, exposes a native entry point via .NET","kind":"post","source":"x","publisher":null,"text":"#CerealLoader, the only on-disk component, exposes a native entry point via .NET VTable Fixups to invoke unmanaged shellcode before any managed code runs. It also abuses the Native Image Cache to plant precompiled malicious images that Exchange loads instead of the originals. 5/6\n\nlikes 2 reposts 0","published_at":"2026-11-10T10:00:07+00:00","relation":"describes","confidence":null,"note":null},{"id":114325,"url":"https://x.com/ESETresearch/status/2120094141916885125","title":"@ESETresearch: Our full technical analysis of Turla's Cereal toolset is available in the white ","kind":"post","source":"x","publisher":null,"text":"Our full technical analysis of Turla's Cereal toolset is available in the white paper: https://t.co/uLMB5T7qsg \nIoCs are included there and also in our GitHub repo: https://t.co/wAyEQxnaBy\n6/6\n\nlikes 4 reposts 0","published_at":"2026-11-10T10:00:07+00:00","relation":"describes","confidence":null,"note":null},{"id":114344,"url":"https://x.com/TheHackersNews/status/2120096413468266635","title":"@TheHackersNews: 🚨 Russian-linked Turla hackers are using new Cereal malware to steal government ","kind":"post","source":"x","publisher":null,"text":"🚨 Russian-linked Turla hackers are using new Cereal malware to steal government emails.\n\nThe toolset hides inside Microsoft Exchange processes, intercepts selected messages, and operates without external C2 infrastructure.\n\nSpotted in Kazakhstan and Romania.\n\nDetails: https://t.co/6SDzzUFHqW\n\nlikes 23 reposts 7","published_at":"2026-11-10T10:09:09+00:00","relation":"describes","confidence":null,"note":null},{"id":114343,"url":"https://x.com/BleepinComputer/status/2120095331996119401","title":"@BleepinComputer: Turla hackers use new Ceral malware to spy on govt Exchange servers\nhttps://t.co","kind":"post","source":"x","publisher":null,"text":"Turla hackers use new Ceral malware to spy on govt Exchange servers\nhttps://t.co/wQV353JDOA\n\nhttps://t.co/wQV353JDOA\n\nlikes 10 reposts 4","published_at":"2026-11-10T10:04:51+00:00","relation":"describes","confidence":null,"note":null},{"id":114370,"url":"https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/","title":"BleepingComputer: Turla hackers use new Cereal malware to spy on govt Exchange servers","kind":"blog","source":"blog","publisher":null,"text":"Turla hackers use new Cereal malware to spy on govt Exchange servers\n\nThe Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]","published_at":"2026-11-10T10:04:32+00:00","relation":"describes","confidence":null,"note":null},{"id":114460,"url":"https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html","title":"Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers","kind":"blog","source":"analyst","publisher":null,"text":"ESET report via THN: Turla (Snake) Cereal modular .NET toolset on Microsoft Exchange servers; components CerealRunner, CerealLoader, CerealSprinter, CerealIron, CerealMoth, CerealNeuron (passive backdoor on Exchange-like paths), CerealHermit, CerealBox (injected into EdgeTransport.exe, collects mails with DOC/DOCX/PDF attachments matching hardcoded sender/recipient/subject/attachment lists). Victims: government orgs in Kazakhstan (found 28 Nov 2025) and Romania (compromised 23 Dec 2025, NATO/EU mail targeted). Initial access unknown. No external C2.","published_at":"2026-11-10T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":101308,"url":"https://news.ycombinator.com/item?id=50412394","title":"Early Hackers Used Whistles from Cap'n Crunch Cereal Boxes","kind":"post","source":"hackernews","publisher":null,"text":"Early Hackers Used Whistles from Cap'n Crunch Cereal Boxes\nhttps://www.atlasobscura.com/articles/capn-crunch-whistle\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-08T11:39:59+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}