Turla Cereal Malware: Spy Toolkit Hid Inside Microsoft Exchange Servers to Copy Government Email, What Is Confirmed and What Exchange Owners Should Check

ESET researchers say an espionage group called Turla put a new malware toolkit, which ESET named Cereal, on Microsoft Exchange servers at two government organizations. It copied selected email while normal mail kept flowing. If your business runs its own Exchange server, this matters: the attackers did not need a server of their own. They controlled the toolkit through the victim's own internet-facing Exchange server, so their traffic looked like ordinary Exchange web traffic.

What happened with Turla and the Cereal malware

ESET researcher Matías Porolli published the findings on Tuesday, November 10, 2026. ESET first found the toolset at a government organization in Kazakhstan on November 28, 2025. After tuning its detections, it found the toolset again a month later at a Romanian government organization. ESET says that organization had been compromised since December 23, 2025. In Romania, the email collection module was set to target messages involving NATO and EU addresses.

ESET describes the toolset as modular and built for long-term spying on Exchange servers. The report says: "No external network infrastructure was observed." Instead, "the victim's own internet-facing Exchange server is the operator-accessible control point."

What is confirmed and what is not

How Cereal malware works inside Exchange

Cereal is a set of .NET components that work together. The main ones are:

• CerealNeuron, a passive backdoor. It does not call out to an attacker. It waits for incoming web requests on the Exchange server at three paths: /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/. In ESET's words, "If a request looks wrong, CerealNeuron redirects the client to a legitimate-looking Exchange error page."
• CerealRunner, which runs encrypted programs in memory. ESET lists the commands it saw: retrieving mailboxes or messages through Exchange Web Services, querying Active Directory, running WMI queries, extracting LSA Secrets (credentials Windows stores locally), listing volume snapshots, and listing, reading and deleting files.
• CerealHermit, a version of the backdoor with no network functions. It reads commands from encrypted files on disk and writes encrypted results back.
• CerealBox, the email collector. It is injected into EdgeTransport.exe, the Exchange process that moves mail. A message qualifies if it has a .doc, .docx or .pdf attachment and matches lists of senders, recipients, subjects or attachment names. Matching messages are compressed, encrypted and saved to files on disk. ESET writes that "Email continues to flow normally."
• CerealLoader, which starts the chain. In some cases the attackers put loader files in the .NET native image cache, a system folder of precompiled libraries, under names that match real Exchange libraries such as Microsoft.Exchange.Search.Mdb.ni.dll.

The detail that matters most to people who run Exchange is how CerealBox reads mail. Malicious transport agents normally show up in Exchange's configuration, where an admin can see them. CerealBox avoids that. ESET says: "CerealBox doesn't add a new agent; it hijacks existing ones loaded in memory." Your list of transport agents can look completely normal while mail is being copied.

Why it matters for a business running Exchange

The two victims ESET named are government bodies. Nothing in the report says Cereal has been used against businesses. The methods themselves are not specific to government, though. Any organization that runs Exchange on its own servers has the same parts: an internet-facing server, the transport process and the .NET cache. Contracts, invoices, payment changes and legal correspondence all pass through that server. Firms that work with government, such as contractors, law firms and suppliers, hold exactly the kind of mail spies want.

The bigger point for anyone running their own mail server is that normal-looking behaviour does not prove a server is clean. Mail flowed, the agent list looked unchanged, and nothing called out to a strange server. If nobody in your company owns patching and monitoring for the Exchange server, start there. We wrote about that gap in Who Is Patching the Software That Runs Your Business?.

Age matters too. Microsoft's lifecycle page shows that extended support for Exchange Server 2019 ended in October 2025. A server that no longer gets security updates is an easier way in, whatever the attacker.

How to check your Exchange server for Cereal malware this week

Turla Cereal malware questions people are asking

What is Cereal malware?

Cereal is a set of .NET malware components that ESET found on Exchange servers. ESET says it gives attackers a hidden backdoor and copies selected email, mainly messages with Word or PDF attachments.

Who is Turla?

Turla is a long-running espionage group that ESET describes as Russia-aligned. ESET named CerealNeuron after Neuron, a malware family that the UK's NCSC attributed to Turla in 2017.

Is there a patch for Cereal?

No. Cereal is malware, not a flaw in Exchange. ESET has not said how the attackers got in, and no CVE is linked to it. Keeping Exchange on a supported, fully updated version is still the baseline.

Does Cereal affect Microsoft 365 or Exchange Online?

ESET's report does not mention Exchange Online. It describes the organizations' own Exchange servers, with malware running inside processes and files on those servers.

Would email stop working if my server were infected?

No. ESET says email continues to flow normally while CerealBox copies matching messages, which is why it is hard to notice.

How do I know if my Exchange server has Cereal?

Check your servers against ESET's published file hashes and look for requests to the three listener paths. Make sure memory scanning is running on the server. ESET found no outside command server, so blocking known bad addresses will not catch it.

The bigger lesson

Running your own mail server means you also own the job of watching it, and as this case shows, "nothing looks wrong" is not the same as "nothing is wrong." If you host Exchange or other core systems yourself, set up patching, logging and memory-level monitoring before you need them, and decide who responds when an alert fires. Our self-hosting and infrastructure work is built around that kind of ownership.

To review how your servers are secured, see security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: ESET WeLiveSecurity: Exchange for breakfast: Turla's Cereal tricks are not for kids; ESET malware-ioc repository, Turla indicators; Microsoft Lifecycle: Exchange Server 2019.