Turla Cereal malware targets Exchange servers

What happened

ESET published research on 10 November 2026 describing a previously undocumented toolset called Cereal, built to run on Microsoft Exchange servers. The Hacker News reports that it was seen against two governmental entities, in Kazakhstan and Romania, in late 2025. Security Affairs says ESET found it on 28 November 2025 in Kazakhstan, and that the Romanian body was compromised on 23 December. BleepingComputer gives the same Romanian date.

Infosecurity Magazine reports that ESET attributes Cereal with high confidence to Turla, also known as Snake and Uroburos. BleepingComputer links the group to Russia’s Federal Security Service (FSB). Security Affairs adds that CISA assesses the actor to be affiliated with Center 16 of the FSB.

How it works, according to the outlets:

No external command server. Infosecurity Magazine reports that ESET found no external command-and-control (C2) infrastructure; each compromised Exchange server acted as the C2 itself. Security Affairs says the main backdoor, CerealNeuron, waits for commands on web paths that look like Outlook Web Access, Autodiscover and ActiveSync traffic. Requests that are not properly encrypted get a normal-looking Exchange error page.
Email collection. BleepingComputer says a component named CerealBox injects into Exchange’s EdgeTransport.exe process and hijacks the handlers of existing transport agents. It runs in memory without registering a new transport agent or interrupting mail delivery. The Hacker News says it looks for messages with DOC, DOCX or PDF attachments that match hard-coded sender, recipient, subject or attachment-name lists. Matching mail is compressed, encrypted and staged on disk, then exfiltrated and deleted through CerealNeuron commands.
Commands as disposable programs. Commands arrive as separate compiled .NET programs carried by CerealRunner. The Hacker News lists retrieving mailboxes or messages, querying Active Directory, running WMI queries, extracting LSA Secrets, listing volume snapshots and file operations.
Fallback variant. CerealHermit has no network functions and reads commands from encrypted files on disk. BleepingComputer notes that ESET did not explain how attackers place those files or retrieve results.
Targeting. At the Romanian victim, CerealBox was configured to collect mail involving NATO and European Union addresses, per BleepingComputer and Infosecurity Magazine.

Initial access is not confirmed. CSO Online notes that no vulnerability, stolen credential or phishing email is named in the research. The Hacker News says only that the group is known for spear-phishing, watering hole and ISP-level adversary-in-the-middle attacks.

Am I affected?

The sources name only two victims, both national government bodies, in Kazakhstan and Romania. They do not report Cereal at other organizations. Exposure is relevant mainly to anyone running Microsoft Exchange servers, and especially government bodies.

Because the entry method is not confirmed, the sources give no way to rule out exposure by patch level. No CVE, affected version or fix is named; all of these are not confirmed.

Indicators that Security Affairs says defenders should check for:

Unusual DLL files in the Windows management folder, for example names like ncobjapi.dll.
Unexpected files in the .NET native image cache, for example names like Microsoft.Exchange.Search.Mdb.ni.dll.
Suspicious requests to the three web paths the backdoor uses (Outlook Web Access, Autodiscover and ActiveSync style paths).

Security Affairs also says a clean list of Exchange transport agents does not necessarily mean the mail system is free from compromise.

What to do now

Obtain ESET’s indicators of compromise. BleepingComputer and Infosecurity Magazine say they are on ESET’s GitHub page, and Infosecurity Magazine adds that they are also in ESET’s white paper.
Search Exchange servers for the artifacts listed above: unusual DLLs in the Windows management folder, unexpected files in the native image cache, and odd requests to the Outlook Web Access, Autodiscover and ActiveSync paths.
Do not rely on the Exchange transport agent list alone. CerealBox registers no new agent, so nothing shows in the configuration (Security Affairs).
Watch for unexpected code loading into Exchange’s transport process (EdgeTransport.exe), as suggested by Frank Dickson of Dickson Research in CSO Online.
Consider the same expert’s wider advice in CSO Online: migrate or retire on-premises Exchange where possible, treat remaining servers as tier-zero assets, and limit internet exposure of Outlook Web Access and ActiveSync to what the business needs. This is one commentator’s opinion, not an ESET or vendor instruction.
If you find a match, treat it as a compromise of the server. Because the tools can extract locally stored credentials and query Active Directory (BleepingComputer), the sources imply the scope may reach beyond mail. The sources give no formal response steps.

Update, 12 November 2026

The Record reports that Romania’s intelligence service (SRI) says it detected the intrusion at a government institution in December 2025, contained it and restored the affected email service.
The SRI publicly attributes the operation to Turla. This is the agency’s claim, and The Record does not independently verify it.
The SRI says the attackers exploited vulnerabilities in Microsoft systems. It did not name the vulnerabilities, any CVE identifiers or patch versions, so the entry method remains unconfirmed in the sources.
In the agency’s words, “No exfiltration of sensitive data was identified.”
The SRI did not name the targeted institution. It says Romanian authorities are investigating other potentially related cyber operations linked to Russia.

Turla Cereal malware hides in Exchange servers to steal email