Russian state-linked hackers used a previously undocumented malware toolkit to infiltrate government Microsoft Exchange servers in Romania and Kazakhstan, intercepting selected email communications while leaving normal mail delivery intact.
Researchers at ESET identified the malware, called Cereal, in both countries. In Romania, the toolkit was configured to collect correspondence involving NATO and European Union institutions, exposing a potential channel for sensitive diplomatic and government communications.
The findings, detailed in ESET's Nov. 10 research, describe a sophisticated cyberespionage operation that hides inside legitimate Exchange processes, executes commands in memory, and uses compromised servers for command and control.
How Cereal malware intercepts Microsoft Exchange email
Cereal is a modular toolkit containing eight interconnected components, each responsible for a different part of the attack.
ESET attributes the malware with high confidence to Turla, also known as Snake or Secret Blizzard, a cyberespionage group widely associated with Russia's Federal Security Service (FSB).
The group has targeted governments and diplomatic organizations for more than two decades. Previous investigations also uncovered cooperation between Turla and Gamaredon, another Russian state-linked hacking operation.
Cereal's most distinctive component is CerealBox, which operates inside Microsoft's Exchange email transport service.
Ordinary Exchange transport agents handle tasks such as spam filtering and mail processing. Administrators can inspect registered agents through Exchange's configuration.
CerealBox instead injects itself into the legitimate EdgeTransport.exe process and hijacks handlers belonging to agents already running in memory.
The malware intercepts selected messages without registering a new transport agent, leaving Exchange's agent configuration unchanged.
What information does CerealBox collect?
The malware searches for messages containing specific document attachments:
- Microsoft Word files (.doc and .docx).
- PDF documents (.pdf).
Messages must also match at least one configured criterion, including sender or recipient addresses, subject text, or attachment filenames. Exclusion lists filter out unwanted messages.
Matching emails are compressed, encrypted, and stored temporarily before the attackers retrieve them and delete the staged files.
Email delivery continues normally, reducing the chance that users will notice unusual activity.
Other Exchange persistence attacks have manipulated mailbox permissions through Outlook Web Access to maintain unauthorized access.
CerealBox uses a different approach, intercepting mail directly within Exchange's transport process.
ESET says this method of hijacking existing transport-agent handlers has not previously been documented in another malware family.
Turla turns compromised Exchange servers into command centers
Cereal also avoids a common indicator of malware activity: repeated outbound connections to attacker-controlled command-and-control servers.
ESET found no dedicated external command infrastructure associated with the observed intrusions.
Instead, a component called CerealNeuron waits for incoming requests on the compromised Exchange server.
The requests arrive through web paths resembling legitimate Microsoft Exchange services, including Outlook Web Access, Autodiscover, and ActiveSync.
One observed path was /owa/sdds/.
When an incoming request passes the malware's encryption and integrity checks, CerealNeuron decrypts its contents and executes the supplied command.
Requests that fail validation receive a legitimate-looking Exchange error response.
This allows malicious requests to blend into ordinary HTTPS traffic.
Attackers have previously concealed command traffic through legitimate cloud APIs. Cereal instead uses the compromised Exchange server itself as the control point, limiting the effectiveness of defenses focused on known malicious destinations.
Eight components support long-term access
ESET identified several specialized tools working together:
- CerealLoader: Loads encrypted .NET assemblies and uses unusual execution techniques to evade analysis.
- CerealRunner: Packages and executes commands delivered as separate programs.
- CerealNeuron: Receives encrypted commands through incoming web requests.
- CerealHermit: Executes commands stored in encrypted files when network-based access is unavailable.
- CerealBox: Intercepts and collects selected email messages.
- CerealSprinter, CerealIron, and CerealMoth: Support payload execution and injection into legitimate processes.
The toolkit also abuses Windows Management Instrumentation components and the .NET native image cache to execute malicious code inside trusted processes.
Attackers disguised components using filenames associated with legitimate Windows libraries, including ncobjapi.dll and wbemcomn.dll.
ESET identified commands capable of querying Active Directory, retrieving mailboxes, collecting stored credentials, inspecting running processes, and accessing files.
The modular design allows operators to execute specialized commands without maintaining one large backdoor containing every capability.
Government organizations in Romania and Kazakhstan targeted
ESET first discovered Cereal on a government Exchange server in Kazakhstan on Nov. 28, 2025.
After improving its detection methods, the company identified the same toolkit at a Romanian government organization compromised on Dec. 23, 2025.
The Romanian installation was configured to identify emails sent to or received from NATO and EU institutional addresses.
The targeting aligns with Turla's established intelligence-gathering activities across Europe and Central Asia.
ESET telemetry indicates that approximately 70% of countries targeted by Turla since 2022 were former Soviet republics or European countries historically aligned with the Soviet Union.
Researchers also observed increased activity on the Kazakhstan server on Jan. 15, 2026, immediately after the Old New Year holiday observed in Russia and several neighboring countries.
ESET has not determined how the attackers initially gained access to either server, the full extent of the compromises, or the total amount of information stolen.
The Romanian configuration establishes which correspondence the malware was intended to collect, but the researchers did not quantify how many matching messages were successfully obtained.
What Exchange administrators should investigate
Cereal's ability to hide inside legitimate Exchange processes complicates detection through conventional antivirus alerts and network blocklists.
Administrators responsible for internet-facing Exchange servers should prioritize the following checks:
- Inspect Exchange processes. Investigate unexpected code injection or unfamiliar assemblies loaded by EdgeTransport.exe.
- Review suspicious web requests. Examine logs for unusual traffic reaching Exchange paths identified in ESET's research, including
/owa/sdds/. - Verify system libraries. Compare suspicious ncobjapi.dll and wbemcomn.dll files against trusted Microsoft versions and investigate unexpected files in the .NET native image cache.
- Examine mail collection activity. Look for unexplained encrypted archives, temporary email dumps, and unauthorized mailbox access.
- Review credential and directory access. Investigate unusual Active Directory queries, credential access, and execution of unfamiliar .NET assemblies.
ESET has published indicators of compromise to support threat hunting, including technical details that administrators can use to investigate potentially affected systems.
Security teams should also maintain supported Exchange versions, apply security updates, restrict unnecessary internet exposure, and investigate abnormal administrative activity.
Researchers have not identified a specific Exchange vulnerability responsible for the initial compromises, so applying patches alone cannot establish whether an affected server is clean.
Cereal's interception technique also requires defenders to examine the processes handling email, not only user authentication records or outbound network connections.
For organizations managing sensitive correspondence, investigating unexpected Exchange process behavior and signs of email collection is essential to detecting this form of persistent espionage.
Also read: Russian-linked hackers used compromised websites to target iPhones and Android devices in another espionage campaign reported in November.