Turla Cereal Malware: Russian Spies Turned Government Exchange Servers Into Hidden Control Hubs, What Is Confirmed and What to Check on Yours

ESET researchers say the Russian espionage group Turla planted a new toolset, which ESET calls Cereal, on government Microsoft Exchange email servers in Kazakhstan and Romania, and used each hacked server as its own hidden control center. If your business runs its own Exchange server, this matters because the implant hid inside normal Exchange traffic and processes, so an out-of-date or unwatched mail server can quietly become someone else's listening post.

ESET published the research on November 10, 2026. Below is what the report confirms, what it does not, and what to check on your own Exchange server this week.

What happened with Turla and Exchange

This comes from ESET's write-up by researcher Matías Porolli:

• ESET found Cereal at a government organization in Kazakhstan on November 28, 2025.
• After tuning its detections, ESET found it about a month later at a government organization in Romania, which had been compromised on December 23, 2025.
• In Romania, the email collection component was set up to collect messages involving NATO and EU institutional addresses.
• ESET attributes the toolset to Turla with high confidence, based on a component linked to Turla and similarities to older Turla malware.

ESET also says around 70% of the countries Turla has targeted since 2022 are former Soviet republics or European countries once closely aligned with the Soviet Union, based on its own telemetry.

How Cereal malware works on an Exchange server

Cereal is a modular .NET toolset. These are the parts that matter if you look after a mail server:

• No outside command server. ESET found no external command-and-control infrastructure. A passive backdoor, CerealNeuron, waits on the Exchange server for incoming web requests on paths that look like Outlook on the web, Autodiscover and ActiveSync. That leaves no suspicious outbound connection for a firewall to flag.
• Email theft inside the transport service. A component called CerealBox is injected into EdgeTransport.exe, Exchange's mail transport process, and hijacks the handlers of existing transport agents in memory. It picks out messages with .doc, .docx or .pdf attachments that match lists of senders, recipients, subjects or attachment names, then compresses, encrypts and stores them on disk to be taken later.
• Nothing new in the Exchange configuration. ESET says Cereal does not register its own transport agent. If Get-TransportAgent shows a clean list, that does not rule it out.
• Hiding in Windows. A loader sits at C:\Windows\System32\wbem\ncobjapi.dll, where WMI loads it, and it passes legitimate calls through so the host process keeps working normally. Other pieces abuse the .NET native image cache.
• Commands that look like admin work. Commands arrive as separate programs that pull mailboxes through Exchange Web Services, query Active Directory, run WMI queries, extract LSA secrets, and list, read or delete files.

What is confirmed and what is not

To put it plainly: two government victims are confirmed, and nothing in the report says businesses were targeted. But nothing about the technique only works against governments.

Why this matters for a business running Exchange Server

Many companies still run on-premises Exchange for good reasons: a law firm with data handling rules, a manufacturer with older software tied to mail, a medical practice that wants records on its own hardware. That server holds every contract, invoice and password reset that passes through the company, and it has to face the internet to do its job.

Cereal shows how an attacker can turn that server into a quiet collection point. It uses the server's own web paths, its own transport process and Windows' own management tools. If nobody is watching the server, and nobody is patching it, you may see no sign at all.

Many businesses have also missed a support deadline. Microsoft's lifecycle page shows Exchange Server 2019 extended support ended in October 2025. Microsoft then sold paid Extended Security Updates for Exchange 2016 and 2019 to Enterprise Agreement customers, valid until the end of October 2026. In an October 13, 2026 update, Microsoft said there will be no more updates released for Exchange 2016 or 2019, and that updates will be released for Exchange Server Subscription Edition (SE) only. Microsoft adds that this does not mean those older versions are safe from future security issues. If you are still on 2016 or 2019, any new Exchange flaw found from now on will stay open on your server.

We covered the wider question of who keeps business servers patched in Who Is Patching the Software That Runs Your Business?, and why an update notice is not proof of protection in Updated Is Not the Same as Patched.

Exchange server security checklist for this week

If anything matches, do not just delete the file. Preserve the logs, take the server off the internet, and bring in incident response help. ESET describes Cereal querying Active Directory and extracting LSA secrets, so assume domain credentials may be exposed and plan password resets for them.

If running your own mail server no longer makes sense for your team, our self-hosting and infrastructure page explains how we think about what to host yourself and what to hand off.

Turla Cereal malware questions people are asking

What is Cereal malware?

Cereal is the name ESET gave to a modular .NET espionage toolset it found on Exchange servers. It includes a backdoor, a set of loaders and runners, and a module that steals selected email from Exchange's transport service.

Is there a patch for Turla Cereal?

No. Cereal is malware that runs after a break-in, not a flaw in Exchange, and ESET names no CVE. Patching shuts the doors an attacker might use to get in, but it does not remove an implant that is already there.

How did Turla break into the Exchange servers?

Nobody knows yet. ESET's report does not describe how the attackers first got in.

Were NATO and the EU hacked?

ESET does not say so. It says the Romanian government server was set up to collect messages involving NATO and EU addresses, which is different from a breach of NATO or EU systems.

Does this affect Microsoft 365 or Exchange Online?

ESET's report describes on-premises Exchange servers. It does not describe any compromise of Exchange Online.

Would checking my transport agents find it?

Not on its own. ESET says Cereal does not register a transport agent and instead hijacks existing ones in memory, so you also need file, log and process checks.

The bigger lesson

A mail server is not a box you set up once and forget. It holds the company's most sensitive conversations, it faces the internet, and attackers like Turla clearly see it as a place to set up camp. If you run one, someone needs to own its version, its updates and its monitoring, or you need a plan to move off it.

For help hardening or replacing your Exchange setup, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: ESET Research, Exchange for breakfast: Turla's Cereal tricks are not for kids; ESET malware IoC repository, Turla; Microsoft Exchange Team, Period 2 Exchange 2016/2019 ESU program; Microsoft Lifecycle, Exchange Server 2019.