Turla’s new Cereal malware quietly copied government email from inside Exchange servers

ESET researchers have published details of Cereal, a previously undocumented set of malware tools built to live inside Microsoft Exchange mail servers. In a report published on November 10, 2026, ESET says it found Cereal at two national government organizations, one in Kazakhstan and one in Romania, and attributes it with high confidence to Turla, a long-running espionage group widely assessed to be part of Russia’s Federal Security Service (FSB).

This isn’t malware that spreads to home computers. It’s a targeted spying tool for organizations that run their own Exchange servers. We’re covering it because it shows how far a well-resourced attacker will go to read email without being noticed.

What ESET found

ESET says it first found the toolset on an Exchange server at a Kazakh government organization on November 28, 2025. After improving its detections, it found the same tools at a Romanian government organization that had been compromised on December 23, 2025. In Romania, the email-collecting part was set up to pick out messages sent to or from NATO and European Union addresses. ESET says activity in Kazakhstan surged on January 15, 2026.

ESET’s blog post doesn’t describe how the attackers first got into either server. ESET says the full technical analysis is in a white paper, with indicators of compromise on its GitHub.

How Cereal works

ESET describes a set of small, cooperating .NET components. The ones that matter most:

• CerealBox reads mail as it flows. Rather than installing a visible Exchange “transport agent” (a legitimate plug-in that sees every message), it is injected into Exchange’s own mail-handling process and wraps the agents that are already loaded. Mail keeps flowing normally, and nothing new shows up in Exchange’s settings. It keeps copies of messages with .doc, .docx or .pdf attachments that match lists of senders, recipients, subjects or file names, then compresses, encrypts and stores them on disk for collection. ESET says this technique hasn’t been documented for any malware before.
• CerealNeuron is the backdoor. It doesn’t call home. It waits for encrypted requests on web paths that look like normal Outlook on the web, Autodiscover and ActiveSync traffic, runs any request that passes its checks and redirects anything else to an ordinary-looking Exchange error page. That means the victim’s own internet-facing mail server is the control point, and there’s no attacker server for defenders to find or block. ESET says it couldn’t identify the IP addresses the operators used.
• CerealRunner delivers each command as its own tiny compiled program, run in memory: for example, pulling mailboxes through Exchange Web Services, querying Active Directory, listing processes or reading stored Windows credentials. ESET found many near-identical copies, which it says points to an automated framework for building them.

ESET also documents unusual tricks to hide the loader, including code that runs before the .NET runtime’s normal entry point, a disguise as a Windows Management Instrumentation file, and planting files in .NET’s cache of precompiled libraries so Exchange loads them by mistake.

What’s demonstrated, and what’s inference

The two compromises, the components and how they work are ESET’s direct findings from the infected servers. The attribution to Turla is ESET’s assessment, based on a component already publicly linked to Turla being used at the same time and similarities to older Turla malware such as Neuron, which the UK’s National Cyber Security Centre documented in 2017. ESET’s comments on why these targets might interest Russia, such as Romania’s NATO role or Russian exiles in Kazakhstan, are context, not evidence.

What this means for you

If you don’t run an Exchange server, there’s nothing to change on your devices. The people affected are the governments whose mail was read and the people who wrote to them. It’s a reminder that an email’s security depends on every server it passes through, not just your own inbox.

What you can do (if you run Exchange)

1. Check ESET’s indicators of compromise from the report against your Exchange servers, including unexpected DLLs in the WMI folder and in .NET’s native image cache.
2. Keep Exchange fully patched, and limit which parts of it are reachable from the internet. The paths CerealNeuron hides on are ones many organizations must expose, so watch their logs for unusual request patterns rather than assuming they’re benign.
3. Use endpoint protection that watches memory and process injection on servers, not only workstations. Cereal leaves very little on disk.
4. Consider whether a hosted mail service is a better fit. Running Exchange yourself means owning this kind of risk.

How Frame helps

Cereal steals email content from organizations, not account passwords from the public, so there’s no breach to add. Frame can look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan mail servers.

Related coverage

• Poisoned websites delivered data-stealing exploits to outdated iPhones and Android phones: another espionage campaign attributed to a Russian state group, this time aimed at phones.
• France says an Iranian unit sabotaged fridges at about 700 supermarkets: another state attribution published this week, with a very different goal.

Sources

• ESET Research (WeLiveSecurity), Exchange for breakfast: Turla’s Cereal tricks are not for kids, November 10, 2026
• Help Net Security, Turla’s Cereal malware turns victims’ Exchange servers into spy hubs, November 10, 2026