--- id: "CMP-202611-qduyyn" page: "https://infrastack.ai/live/CMP-202611-qduyyn" kind: "campaign" aliases: [] title: "Russia's Turla spy group hides new Cereal malware inside Microsoft Exchange servers to steal government emails (ESET)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Microsoft Exchange Server", "fixed": [], "affected": "on-premises (version not stated)", "ecosystem": "vendor"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T10:40:01+00:00" updated_at: "2026-11-10T10:40:35+00:00" sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html", "first_seen_at": "2026-11-10T10:40:01+00:00", "cites": ["https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html"]}] exploit_sources: [] --- # Russia's Turla spy group hides new Cereal malware inside Microsoft Exchange servers to steal government emails (ESET) Link for people: https://infrastack.ai/live/CMP-202611-qduyyn (this .md is for agents) ESET found Cereal, a new modular .NET toolset used by the Russia-aligned (FSB-linked) Turla group to turn Microsoft Exchange servers into long-term email collection points. Confirmed victims: a national government organization in Kazakhstan (found 28 Nov 2025) and one in Romania (compromised 23 Dec 2025), where it was set to collect mail involving NATO and EU addresses. The backdoor CerealNeuron has no external command server: it listens on the Exchange server for encrypted requests on paths that look like normal Exchange traffic (Outlook Web Access, Autodiscover, ActiveSync) and runs compiled .NET programs sent to it. CerealBox is injected into EdgeTransport.exe and hijacks transport agents already loaded in memory, so no new transport agent shows up in Exchange's configuration. It copies emails with DOC, DOCX or PDF attachments that match hardcoded sender, recipient, subject or attachment-name lists. The commands can pull mailboxes, query Active Directory, run WMI queries, extract LSA secrets and handle files. How the attackers got in: unknown. Ingress IPs: unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Microsoft Exchange Server affected on-premises (version not stated) fixed no fixed version listed ## Cause How the attacker got in: not disclosed yet (unknown). The record states 'How the attackers got in: unknown' and describes the compromise as confined to the victim's Exchange servers and mailboxes, with no mention of users, customers or dependents being reached through a tampered install, third-party breach, or phishing. How it reached others: it stayed inside (none). Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown ## How to check On on-premises Microsoft Exchange servers, check against ESET's Cereal IoCs (in ESET's white paper and ESET's malware-ioc GitHub repo). Standard checks will miss it: there is no outbound C2 traffic and no newly registered transport agent. Look for: unexpected code injected into EdgeTransport.exe; HTTP listeners registered by processes other than Exchange's own on Exchange-like URI prefixes (OWA, Autodiscover, ActiveSync paths); tampered or unexpected precompiled images in the .NET Native Image Cache that Exchange loads instead of the originals; .NET assemblies that run native code before their managed entry point (VTable Fixups) or that pose as Windows DLLs; and encrypted or compressed staging files on the Exchange server. ESET names the components CerealRunner, CerealLoader, CerealSprinter, CerealIron, CerealMoth, CerealNeuron, CerealHermit and CerealBox. ## Fix Run ESET's published IoCs and detections across all on-premises Exchange servers. If you find a hit, treat the server and every mailbox on it as compromised: rebuild Exchange from clean media rather than cleaning it up, rotate credentials on the server and in AD (LSA secrets may have been taken), and review AD for changes. Keep Exchange fully patched. Only expose OWA, Autodiscover and ActiveSync where they are needed. Government, diplomatic and defense organizations, especially those that exchange mail with NATO or the EU, should hunt for this first. ## Timeline - 2026-11-10T10:40:01+00:00 analyst https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html ## Documents - [describes] @ESETresearch: #ESETresearch has uncovered Cereal, a previously undocumented modular .NET tools https://x.com/ESETresearch/status/2120094134559965410 - [describes] @ESETresearch: We identified two national governmental organizations compromised by Cereal: one https://x.com/ESETresearch/status/2120094137307263392 - [describes] @ESETresearch: The main backdoor, #CerealNeuron, is a passive implant with no external C&C. https://x.com/ESETresearch/status/2120094138536202485 - [describes] @ESETresearch: The email collection module, #CerealBox, is injected into Exchange’s EdgeTranspo https://x.com/ESETresearch/status/2120094140092285147 - [describes] @ESETresearch: #CerealLoader, the only on-disk component, exposes a native entry point via .NET https://x.com/ESETresearch/status/2120094141048619129 - [describes] @ESETresearch: Our full technical analysis of Turla's Cereal toolset is available in the white https://x.com/ESETresearch/status/2120094141916885125 - [describes] @TheHackersNews: 🚨 Russian-linked Turla hackers are using new Cereal malware to steal government https://x.com/TheHackersNews/status/2120096413468266635 - [describes] @BleepinComputer: Turla hackers use new Ceral malware to spy on govt Exchange servers https://t.co https://x.com/BleepinComputer/status/2120095331996119401 - [describes] BleepingComputer: Turla hackers use new Cereal malware to spy on govt Exchange servers https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/ - [describes] Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html - [discussion] Early Hackers Used Whistles from Cap'n Crunch Cereal Boxes https://news.ycombinator.com/item?id=50412394 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_