Follow us on Google News
The Russia-aligned state-sponsored cyber espionage group known as Turla has deployed a previously undocumented toolset called Cereal to infiltrate Microsoft Exchange servers and systematically harvest sensitive government correspondence. Slovakian cybersecurity firm ESET reported that the advanced framework was observed targeting state entities in Kazakhstan and Romania in late 2025. Designed for covert, long-term intelligence gathering, the software operates with minimal disk footprint and avoids external command-and-control servers by abusing compromised internal email infrastructure directly.
Stealth Architecture within Corporate Mail Servers
The malware derives its name from its extensive reliance on data serialization, a technique that converts complex data structures into portable formats for storage and reconstruction. Unlike conventional malware variants that communicate with external operational servers, Cereal manipulates legitimate Exchange processes to receive instructions and exfiltrate information. ESET noted that the platform demonstrates a sophisticated grasp of Microsoft Exchange internals, transforming the victim system into both an execution hub and a resilient repository for classified intelligence.
The complete framework comprises eight distinct components that coordinate tasks across the compromised environment. An initial component known as CerealRunner deploys loader modules such as CerealLoader and CerealSprinter to decrypt and activate in-memory backdoors. Intermediary utilities, including the injector CerealIron and the method-execution tool CerealMoth, allow the attackers to load and execute compiled .NET assemblies across non-.NET system processes. Commands are received by passive backdoors, notably CerealNeuron and its offline variant CerealHermit, which monitor web paths mimicking standard Exchange traffic.
Automated Interception of Strategic Communications
Email harvesting is executed primarily by CerealBox, an automated module that injects itself directly into the Microsoft Exchange transport process, EdgeTransport.exe. Once embedded within the core message pipeline, the tool screens incoming and outgoing traffic for correspondence containing specific document attachments, including PDF, DOC, and DOCX files. The software filters messages against predetermined lists of sender addresses, recipient domains, and subject headers before compressing and staging the collected material on local disks for encrypted transmission.
During the intrusion directed at a Romanian government organization, investigators found that CerealBox was tailored to single out correspondence linked to institutions of the European Union and NATO. Such targeting reflects strategic geopolitical intelligence priorities closely associated with state-backed operations. Once the identified communications are transferred through CerealNeuron, the stored interim files are deleted to erase forensic traces of the theft.
Framework Automation and Broad Network Reconnaissance
The threat actors dispatch operator instructions in the form of pre-compiled .NET binaries rather than standard text scripts. CerealRunner unpacks these payloads entirely within system memory to carry out tasks that extend beyond email theft. The capabilities include querying Active Directory for users, domain computers, and DNS records, extracting local security authority secrets, executing Windows Management Instrumentation queries, and listing volume shadow copies to map the wider enterprise perimeter.
According to ESET researcher Matías Porolli, the sheer volume of specialized, near-identical binaries strongly indicates that the operators maintain an automated internal pipeline to package each unique task. This modular assembly reveals a mature and thoroughly engineered cyber espionage ecosystem engineered to maintain durable access to critical infrastructure without raising operational alarms.
