Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with the outlet ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.
The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest.
The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added.
The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations.
In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia's strategic priorities.
The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.
Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object's state into a format that can be easily stored, transmitted, and reconstructed.
The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data - Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names.
Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands.
What happened
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails.
According to an ESET report shared with the outlet ahead of publication, the sophisticated and modular tool is designed for long-term intelligence gathering and has been observed against two governmental entities in Kazakhstan and Romania in late 2025.
The toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest.
What changed
The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added.
The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations.
Who is affected
In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia's strategic priorities.
Why it matters
The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.
Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object's state into a format that can be easily stored, transmitted, and reconstructed.
Technical details
The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data - Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names.
Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands.
What remains unknown
The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.