Turla Cereal Malware Turns Microsoft Exchange Servers Into Email Spy and Command Channels

For Exchange administrators, the troubling detail is not simply that attackers could read email. It is that the collection could happen inside legitimate mail-processing activity while messages continued toward their destinations. A working inbox is not a clean bill of health.

Two government victims, targeted correspondence​

ESET’s announcement describes compromises dating to late 2025—not intrusions that necessarily began with the disclosure. BleepingComputer’s Bill Toulas reports that researchers initially discovered the toolset at a government organization in Kazakhstan, then identified it at a Romanian government agency compromised on December 23, 2025.

The Romanian targeting needs a careful distinction: collecting correspondence involving NATO and EU addresses does not establish that NATO or EU infrastructure was itself compromised. The identified collection point was the government organization’s Exchange environment. Nor does the reported configuration establish that every matching message was successfully collected.

CerealBox hides inside Exchange’s mail pipeline​

BleepingComputer’s account of ESET’s technical findings identifies CerealBox as the email-collection component. It injects into EdgeTransport.exe and takes over handlers belonging to existing transport agents, rather than registering an additional agent.

The reported filters include sender, recipient and subject criteria, together with document attachments such as .DOC, .DOCX and .PDF. That describes selective intelligence gathering, not merely an indiscriminate mailbox grab.

Microsoft’s documentation explains why the location matters. Exchange transport agents are an extensibility mechanism: registered assemblies receive events at particular stages of SMTP handling and message routing, giving them access to messages moving through the transport pipeline. The documentation covers Exchange Server 2016, 2019 and Subscription Edition; that documentation scope is not a list of versions confirmed affected by Cereal.

The practical implication: an inventory of registered agents remains useful, but it cannot by itself exclude the reported handler-hijacking technique. That is a defensive inference from CerealBox’s described behavior and Microsoft’s explanation of normal agent registration—not a validated Cereal detection test.

A command channel built around the victim’s server​

The toolset also separates command delivery from execution. BleepingComputer describes three further components:

• CerealNeuron waits for encrypted incoming web requests on paths resembling legitimate Exchange services. It validates and decrypts requests before invoking the supplied execution component.
• CerealRunner carries encrypted.NET programs and their arguments. Those programs execute in memory, with results returned to CerealNeuron for encryption and transmission back to the operators.
• CerealHermit is a non-networked variant that reads commands from encrypted files on disk.

Reported command capabilities include retrieving Exchange email, querying Active Directory for users, groups and DNS records, extracting locally stored credentials, and reading or deleting files. These are described capabilities—not proof that every operation occurred at both organizations.

Hermit’s purpose is less certain. It could provide an alternative when the web-based channel is unavailable, but BleepingComputer notes that ESET did not explain how operators delivered its command files or retrieved results. Calling it a confirmed recovery mechanism would go beyond the evidence.

ESET observed no external command-and-control infrastructure in the examined activity: the compromised Exchange server supplied that function. It also reports encrypted payloads, in-memory execution and abuse of the.NET native image cache. This observation does not establish that external infrastructure was absent from every stage of the intrusions.

What defenders can take from the findings​

Transport-agent abuse is not an entirely new category. MITRE ATT&CK documents malicious Exchange transport agents under T1505.002, including Turla’s earlier LightNeuron malware. Its examples describe collection triggered by attacker-selected email criteria. CerealBox’s reported use of existing handlers makes the distinction between new registration and runtime interference particularly important.

For a focused investigation, the following are reasonable priorities—not an ESET-certified hunting recipe:

1. Review transport components against a trusted baseline. MITRE recommends checking critical service components for unexpected changes and verifying their integrity.
2. Do not treat an unchanged agent list as sufficient assurance. The reported technique warrants examination of suspicious execution within Exchange processes, not configuration alone.
3. Correlate suspicious web activity with host evidence. Based on the reported command channel, unusual requests deserve attention when accompanied by unexpected code execution, credential access or directory queries—not merely because their contents are encrypted.
4. Avoid equating successful delivery with confidentiality. ESET’s description explicitly allows the original message to continue while a copy is selected for collection.

Important gaps remain. The reporting does not establish the affected Exchange builds, initial-access method, exploited vulnerability or a specific patch that prevents Cereal. It should not be presented as an Exchange Online breach or a universal compromise of Exchange customers.

The central lesson is narrower—and more useful: mail-flow health and mail confidentiality are different security questions. Cereal’s reported design targets that gap, using trusted server processes to keep the post moving while someone else reads selected letters.