Turla Cereal Exchange Malware: ESET Finds a Hidden Backdoor and Email Stealer Inside Government Exchange Servers, What Is Confirmed and How to Check Yours

ESET researchers say an espionage group called Turla has been running a modular toolkit, which ESET calls Cereal, inside on-premises Microsoft Exchange servers. The mail server itself became both the attackers' control channel and the place where stolen email was gathered. If your organization runs its own Exchange server, this matters: the mail server is one of the most valuable machines on your network and one of the hardest to inspect.

ESET published the research on Tuesday, 10 November 2026, as a blog post and a full white paper by researcher Matías Porolli. The two confirmed victims were government organizations in Kazakhstan and Romania. The techniques work on any on-premises Exchange server, though, so the lessons apply to every organization that hosts its own mail.

What happened: Turla Cereal malware on Exchange servers

According to ESET's white paper:

• A national government organization in Kazakhstan had been compromised since at least 28 November 2025. Attacker activity rose from 15 January 2026.
• A national government organization in Romania had been compromised since at least 23 December 2025. Activity rose from 20 January 2026. ESET found this second victim after improving its detections.
• In both cases the attackers focused on Exchange servers.
• In Romania, the email collection module was set to pick out messages sent to or from nato.int and europa.eu addresses.
• The earliest version of the loader component ESET found was uploaded to VirusTotal from Kazakhstan on 11 May 2022. ESET says it is still unclear when the toolset was first used.

What is confirmed and what is not

Confirmed by ESET's analysis: the components, how they talk to the operators, how they collect email, the file names and hashes ESET recovered, and the two victims named above.

Assessed, not proven: ESET attributes the toolkit to Turla "with high confidence". It bases this on a known Turla component found alongside Cereal and on similarities to older Turla malware. ESET describes Turla as Russia-aligned and "thought to be" part of Russia's FSB.

Not known: ESET could not determine how the attackers got in. Because the Exchange servers were reachable from the internet, ESET says it is "possible" they were breached through a vulnerability, but it names no specific flaw or CVE. ESET does not say which Exchange versions were running. It could not identify the IP addresses the operators connected from. It also does not say whether there are other victims beyond these two.

How the Cereal toolkit works

A backdoor that waits on your own Exchange server

Most backdoors "phone home" to a server the attackers control. That outbound traffic can be spotted and blocked. ESET found that the main backdoor, CerealNeuron, does the opposite. It sits on the Exchange server and waits for incoming HTTPS requests on web paths that look like normal Exchange traffic. Among those ESET observed:

• /owa/sdds/
• /AUTODISCOVER/PROXYSERVICE/
• /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/

Requests must be correctly encrypted and pass integrity checks. Anything else is redirected to a normal-looking Exchange error page. ESET found no external command server at all, which makes tracking at the network level much harder.

The operators send each command as a separate small program. ESET saw commands that pull mailboxes through Exchange Web Services, query Active Directory, list processes and network connections, extract stored Windows secrets (LSA Secrets), and read or delete files.

ESET also found CerealHermit, which it describes as a variant of CerealNeuron with the network functions removed. Instead of listening for web requests, it reads commands from encrypted files on disk and writes the results back to disk.

Stealing email from inside the transport service

The email collection module, CerealBox, is injected into EdgeTransport.exe, Exchange's mail transport process. Exchange transport agents normally have to be installed and enabled. CerealBox skips that step. It hijacks the routing agents that are already loaded in memory, runs its own code first, then hands control back. ESET says no malware has been documented doing this before.

In practice, no new transport agent appears in your Exchange configuration. A message is captured if it has a .doc, .docx or .pdf attachment and matches a hardcoded list of senders, recipients, subject words or attachment names. Captured mail is compressed, encrypted and written to disk until the operators fetch it. ESET says CerealBox stops processing mail 70 days after its first run.

.NET tricks that keep it off disk

Only one component, CerealLoader, is written to disk as a recognizable .NET file. Everything else is decrypted and run in memory. ESET documented these techniques:

• DLL hijacking: CerealLoader was written to C:\Windows\System32\wbem\ncobjapi.dll, where the Windows WMI host loads it, and was also found posing as wbemcomn.dll.
• .NET native image cache abuse: malicious files were placed under real-looking names such as Microsoft.Exchange.Search.Mdb.ni.dll.
• Code that runs before .NET starts, using a feature called VTable Fixups.

Why this matters for a business running Exchange

The confirmed victims are government agencies, and most businesses will never be a Turla target. But the methods are not tied to government networks. Many law firms, manufacturers, healthcare groups and local authorities still run on-premises or hybrid Exchange. On those servers, Cereal shows three uncomfortable things:

1. A clean transport agent list does not prove a clean server.
2. Watching outbound traffic is not enough when the backdoor only answers incoming requests on normal-looking Exchange paths.
3. The Exchange server holds keys beyond email. The commands ESET saw reached Active Directory and stored Windows secrets.

Also check your version. Microsoft's lifecycle page lists Exchange Server 2016 and Exchange Server 2019 as reaching end of support on 14 October 2025. That means no new security updates. An unsupported, internet-facing mail server is exactly the kind of entry point ESET suspects here.

What to do this week

The first rows come from ESET's published indicators. The rest are general hardening steps we suggest. They are not ESET recommendations.

Turla Cereal questions people are asking

What is Turla?

Turla, also called Snake, is a long-running espionage group that ESET says has been active since at least 2004. It mainly targets governments and diplomatic organizations in Europe, Central Asia and the Middle East.

Is Exchange Online or Microsoft 365 affected?

ESET describes attacks on on-premises Exchange servers only. Its research does not mention Exchange Online.

Is there a CVE or patch for Cereal?

No. Cereal is malware, not a vulnerability. ESET does not know how the attackers got in, and it names no specific flaw.

Would I see the email stealer in my Exchange settings?

Probably not. CerealBox does not register a new transport agent, so it does not show up in Exchange's configuration.

Is my business likely to be targeted?

The two confirmed victims are government bodies. Even so, the same weaknesses (exposed, unpatched or unsupported Exchange) are what other attackers look for too.

The bigger lesson

An on-premises mail server is not just a mailbox. It is an internet-facing Windows server with deep links into your directory. If nobody is clearly responsible for patching it, checking it and eventually retiring it, it can quietly become someone else's control point. Treat the mail server as a security system, give it an owner, and check it against published indicators whenever new research like this comes out.

Want your servers reviewed and hardened? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: ESET WeLiveSecurity: Exchange for breakfast; ESET white paper: Turla's Cereal tricks; ESET Turla IoCs on GitHub; Microsoft Lifecycle: Ending Support in 2025.