Turla Cereal Malware: Russia-Linked Spies Hid Inside Government Exchange Servers to Copy Email, What Is Confirmed and How to Check Yours
ESET says Turla planted a new toolset called Cereal on on-premises Exchange servers at government bodies in Kazakhstan and Romania. The servers themselves were used to control it. Here is what is confirmed, what is not known and how to check your own server.
Where Kazakhstan, Romania · Asia, Central Asia, Europe, Eastern Europe
On this page 8 sections
On November 10, 2026, ESET published research showing that Turla, a long-running espionage group it ties to Russia, hid a new malware toolset called Cereal inside on-premises Microsoft Exchange servers at government organizations in Kazakhstan and Romania. If your company still runs its own Exchange server, this matters: the malware used the mail server itself as the attackers' control point and copied email without changing how mail flowed, so nothing looked broken.
What happened: Turla Cereal malware on Exchange servers
ESET says it found the toolset at a governmental organization in Kazakhstan on November 28, 2025. After tuning its detections, it found the same tools at a governmental organization in Romania that had been compromised on December 23, 2025. Activity in Kazakhstan surged on January 15, 2026.
ESET attributes Cereal to Turla with high confidence. It bases this on a Turla-linked component found alongside Cereal and on similarities with older Turla malware. In the Romanian case, the email collection module was set to pick out messages involving NATO and EU institutional addresses.
How the Cereal toolset works
Cereal is a set of .NET components, each with a cereal-themed name. These are the ones that matter most to defenders:
- CerealLoader is the piece written to disk. ESET found it as
ncobjapi.dllinC:\Windows\System32\wbem\, where the Windows Management Instrumentation service loaded it automatically. In another case it posed aswbemcomn.dllin the same folder. Malicious files were also placed in the .NET native image cache under names such asMicrosoft.Exchange.Search.Mdb.ni.dll. - CerealNeuron is the main backdoor. It listens for web requests on paths that look like normal Exchange traffic:
/owa/sdds/,/autodiscover/proxyservice/and/Microsoft-Server-ActiveSync/integrated/api/. Requests that fail its checks get redirected to a legitimate-looking Exchange error page. - CerealHermit is a fallback with no network ability. It reads encrypted command files from disk.
- CerealBox is injected into EdgeTransport.exe, the Exchange process that moves mail. It wraps the transport agents already loaded in memory. It then copies messages with .doc, .docx or .pdf attachments that match hardcoded lists, and compresses, encrypts and stores them on disk.
Each command arrives as a separate small .NET program that runs in memory. ESET lists what these programs do: export mailboxes through Exchange Web Services, query Active Directory, run WMI queries, extract LSA Secrets (locally stored Windows credentials), list volume snapshots, and read or delete files.
Why this Exchange server compromise is hard to spot
- No outside command server. ESET saw no external command-and-control infrastructure. The victim's own internet-facing Exchange server was the control point, and ESET could not identify the operators' IP addresses. Blocklists of known bad domains do not help here.
- Traffic that looks like Outlook. The backdoor's requests use paths that resemble Outlook on the web, Autodiscover and ActiveSync.
- No new transport agent. ESET writes that "No new agent appears anywhere in Exchange's configuration." An admin who lists transport agents sees only the expected ones.
What is confirmed and what is not known
Confirmed by ESET: the toolset and its components, the two government victims and their dates, the file names and URL paths above, the NATO and EU targeting in Romania, and the attribution to Turla with high confidence. ESET has published file hashes and its detection names, including MSIL/Agent.YCC, MSIL/Agent.YCA, MSIL/Agent.YBZ and Win32/Agent.AIOQ, in its public indicator repository on GitHub.
Not known: ESET does not say how the attackers first got in, which Exchange versions were running, or whether a vulnerability was used. The report covers on-premises servers only and does not mention Exchange Online. The attackers clearly had high-level access, since they wrote files to System32 and injected code into Exchange processes, but the report does not say how they got it. Nothing in the report suggests that organizations outside government were targeted.
Why it matters for a business network
Most companies will never be a Turla target, but the weakness Cereal used applies to any company that runs Exchange. An internet-facing Exchange server sits at the centre of a company's email, holds credentials and talks to Active Directory. Anyone with administrator access to it can read mail, collect passwords and move deeper into the network while the server keeps running normally. Law firms, accounting practices and contractors that handle government correspondence keep exactly the kind of mail this toolset was built to copy.
If your email has moved fully to Microsoft 365, ESET does not describe this toolset as affecting you. If any Exchange server is still running on your network, work through the list below.
Exchange server checklist for this week
| Check | How | What a problem looks like |
|---|---|---|
| Scan for known Cereal files | Load the hashes from ESET's GitHub list into your antivirus or EDR | Any match |
| Inspect the WMI folder | In C:\Windows\System32\wbem\, check the digital signature and modified date of ncobjapi.dll and wbemcomn.dll |
A file not signed by Microsoft, or recently changed |
| Inspect the native image cache | Find Microsoft.Exchange.*.ni.dll files and compare their hashes with ESET's list |
A hash match, or files with no clear origin |
| Search IIS logs | Look for the three URL paths listed above | Repeated requests from the same outside addresses |
| Watch EdgeTransport.exe | Use EDR or Process Explorer to list the modules it has loaded | Unexpected DLLs or injected code |
| Review admin access | List who holds Exchange and domain admin rights, and when each account last signed in | Accounts nobody can explain |
| Patch and reduce exposure | Install the latest Exchange security update and put Outlook on the web behind a VPN or pre-authentication | Exchange admin pages reachable from the open internet |
If you find something, do not just delete it. Isolate the server, preserve the disk and logs, and bring in an incident responder. Because the toolset could extract LSA Secrets, plan to reset every admin and service account password used on that server. A clean transport agent list does not clear you.
If you host your own mail server, our self-hosting and infrastructure page covers how we set up and maintain servers like it.
Turla Cereal malware questions people are asking
What is Turla Cereal malware?
Cereal is ESET's name for a modular .NET toolset that runs on Microsoft Exchange servers. It takes commands through the server's own web traffic and copies selected emails.
Who was affected by Cereal?
Government organizations in Kazakhstan and Romania. ESET first found it on November 28, 2025.
Does Cereal affect Exchange Online or Microsoft 365?
ESET's report describes on-premises Exchange servers only and does not mention Exchange Online.
Which Exchange vulnerability did Turla use?
No one knows yet. ESET does not name a vulnerability or explain how the attackers got in.
How do I check my Exchange server for Cereal?
Scan for the hashes in ESET's GitHub list, check the WMI folder and the .NET native image cache for the file names above, and search your IIS logs for the three URL paths.
Will listing transport agents find it?
No. CerealBox hooks agents that are already loaded, so no new agent shows up in Exchange's configuration.
The bigger lesson
A server that keeps working is not proof that it is clean. Cereal was built to keep email flowing and leave the configuration untouched. The only way to catch something like it is to check files, logs and processes deliberately, on a schedule, with a named person responsible for doing it.
See our security hardening service, or request a quote for a review of your mail server.
Get security alerts by email, with the free checklist, at /security-alerts.
Sources: ESET Research: Exchange for breakfast, Turla's Cereal tricks are not for kids; ESET malware IoC repository, Turla.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now
Fireworks AI says attackers used a hacked third-party cloud provider to reach its development machines and cus...
Turla Cereal Malware: Russian Spies Turned Government Exchange Servers Into Hidden Control Hubs, What Is Confirmed and What to Check on Yours
ESET says Turla hid a new toolset called Cereal on government Exchange servers in Kazakhstan and Romania and u...
Vanderbilt Cyberattack: Campus Told to Shut Down Devices, BYOD Ransomware Gang Claims Data Theft, and What Businesses Should Plan This Week
Vanderbilt University told students and staff to shut down university devices after a cyberattack on November...
