THREAT HORIZON
What broke, who got hit, and what to patch before the sun goes down.
Russia’s Turla Serves Up “Cereal” to Raid Government Inboxes
A new modular toolkit lives inside Microsoft Exchange, takes orders through the mail server itself, and quietly skims off the emails its operators care about.
ESET has documented a previously unknown espionage framework from Turla, one of Russia’s longest-running state hacking groups. The researchers named it Cereal for its heavy reliance on serialization, the technique of packing data or objects into a format that can be stored, shipped across a network, and rebuilt on the other side.
Cereal turned up inside two government organizations, one in Kazakhstan and one in Romania. How the attackers first got in is still unknown. Turla’s usual playbook includes spear-phishing, compromised websites that infect visitors, and intercepting traffic at the internet-provider level.
“A carefully constructed instrument for long-term, stealthy cyber espionage.”— ESET, on the Cereal toolset
Why It’s So Hard to Spot
No outside command server
Instead of calling home to attacker infrastructure that defenders could find and block, Cereal uses a compromised Exchange server as its control point.
Orders arrive as compiled programs
Each command is its own small .NET program, built for one task and run in memory. The sheer number of near-identical builds suggests an automated “command factory.”
Hides inside Exchange itself
The email-stealing module injects into Exchange’s own transport process, and its backdoor listens on web paths dressed up as normal Exchange traffic.
Inside the Cereal Box
Eight components work together. Tap any one to see what it does.
Each box above is a separate piece of the toolkit, from first install down to the email theft.
How the Emails Get Stolen
Watch the flow. CerealBox sits inside Exchange’s transport pipeline and sees mail as it passes through.
Filter for documents. It looks for messages carrying Word or PDF attachments.
Match the hit lists. Messages are checked against built-in lists of senders, recipients, subject lines and file names. At the Romanian target, those lists focused on NATO and EU institutional addresses.
Pack, encrypt, exfiltrate. Matching emails are compressed, encrypted and staged on disk, then pulled out through CerealNeuron and deleted to cover the trail.
The mail server becomes a launchpad
Beyond email, Cereal’s command modules can pull whole mailboxes, query Active Directory for users, computers, groups and DNS records, run WMI queries, extract LSA secrets (stored Windows credentials), list volume snapshots, and manage files. For Turla, a compromised Exchange box is both a listening post and a base for exploring the rest of the network.
🌅 SunsetHost Defender Checklist
0 of 6 done
- Patch and harden on-prem Exchange. Stay on the latest cumulative and security updates, and ask whether that server still needs to exist versus moving mail to a hosted service.
- Audit transport agents and loaded modules. Look for unexpected .NET assemblies or injected code in
EdgeTransport.exeand other Exchange processes. - Review IIS and Exchange web logs. Watch for unusual requests to Exchange-looking paths, especially from internal hosts or at odd hours.
- Hunt for encrypted staging files. Unfamiliar encrypted blobs on Exchange servers, especially ones that appear and disappear, deserve a closer look.
- Protect credentials on the server. Enable LSA protection and Credential Guard where supported, and alert on LSA secret access.
- Fence off the mail server. Limit what Exchange can reach internally so a compromised box can’t freely map Active Directory.
The Bottom Line
Cereal is a polished, factory-built platform, not a pile of scripts. Its whole design is about blending in: no outside servers to block, little left on disk, and everything running inside processes your Exchange server is supposed to run. If you still host your own mail, treat that server as one of the most valuable targets in your network, because state-level attackers already do.