Turla's New 'Cereal' Toolset Lives Inside Exchange: Hijacked Transport Agents Copy NATO and EU Mail, and Each Hacked Server Acts as Its Own C2

High · 2026-11-11 · By H.A

Russia-linked Turla used a new in-memory .NET toolset called Cereal to hijack Exchange EdgeTransport handlers at Kazakh and Romanian government bodies, selectively stealing attachments and NATO/EU correspondence with no external C2.

Overview

The Russia-linked espionage group Turla (also tracked as Snake, Secret Blizzard and Waterbug, and publicly tied to Russia's FSB) has been caught using a new modular .NET toolset, Cereal, that lives inside on-premises Microsoft Exchange servers and quietly copies selected email. Security researchers found it at a government body in Kazakhstan and at a Romanian government agency. In the Romanian case, the operators collected correspondence with NATO and European Union representatives.

Cereal stands out for two reasons. It hides inside Exchange's own mail-transport process, and it uses no external command-and-control infrastructure: each compromised Exchange server acts as its own control point.

The Campaign

Researchers attribute Cereal to Turla with high confidence. They have not disclosed how the attackers first got into the Exchange servers, so this is not a new Exchange vulnerability. It is a post-compromise implant. Organisations should assume that any path to an Exchange server, such as stolen admin credentials, unpatched older flaws or lateral movement, could lead to the same result.

The toolset has four documented components:

• CerealBox injects into Exchange's EdgeTransport.exe process and hijacks the handlers of existing transport agents instead of registering a new one. That lets it inspect mail in memory without interrupting delivery, and it avoids leaving a new transport agent for admins to spot.
• CerealNeuron listens for encrypted web requests on URL paths made to look like legitimate Exchange services. It decrypts each request, runs the supplied payload, and returns encrypted output.
• CerealRunner is a wrapper carrying encrypted .NET programs and their arguments, executed in memory. Researchers found many near-identical, task-specific builds, which suggests an internal framework that automates compiling and packaging.
• CerealHermit is a variant of CerealNeuron with no network capability. It reads commands from encrypted files on disk, probably as a fallback if the web channel is unavailable.

Timeline

• Late 2025: Cereal first found at a Kazakh government body.
• 23 December 2025: A Romanian government agency is compromised. The same toolset is found there about a month after the Kazakh discovery.
• 10 November 2026: Researchers publish their analysis and an extended list of indicators.

Tradecraft

• Selective mail theft: Collection targets messages with .DOC, .DOCX or .PDF attachments, then filters on sender, recipient and subject. In Romania, the filter picked out mail exchanged with NATO and EU addresses.
• Commands observed: Retrieve mail through Exchange Web Services, query Active Directory for users, groups and DNS records, extract locally stored credentials, check processes and network connections, and read and delete files.
• Stealth: Code arrives encrypted, unpacks in memory and leaves very little on disk. Researchers say the group abused the .NET native image cache to run inside legitimate processes.
• C2 design: No outside servers. Operator traffic blends into normal HTTPS requests to the Exchange server itself, which defeats C2 blocklists and domain reputation checks.

Indicators of Compromise

Researchers have published an extended IOC list (file hashes and related artefacts) in their public malware-IOC repository under the Turla folder. Load those into EDR and SIEM tooling rather than relying on network blocklists, because Cereal has no external C2.

Detection

• Audit transport agents and their binaries. Compare the DLLs loaded by EdgeTransport.exe against a known-good baseline. Unexpected .NET modules or modified native images are a red flag.
• Inspect the .NET native image cache (C:\Windows\assembly\NativeImages_*) on Exchange servers for recently created or unsigned images that don't match installed Exchange and .NET builds.
• Review IIS logs for unusual POST requests to paths that look like Exchange services but aren't standard (OWA, ECP, EWS, Autodiscover, MAPI) or that carry encrypted-looking bodies.
• Watch EWS usage: bulk mailbox access by service accounts or from the server itself, outside normal patterns.
• Look for unexplained encrypted files on disk in Exchange directories (possible CerealHermit command files).

# List transport agents and their assemblies, then compare against a baseline
Get-TransportAgent | Format-List Identity,Enabled,Priority,AssemblyPath
# Recently written native images on the Exchange host
Get-ChildItem C:\Windows\assembly\NativeImages_* -Recurse -File |
  Where-Object LastWriteTime -gt (Get-Date).AddDays(-365) |
  Sort-Object LastWriteTime -Descending | Select-Object -First 50 FullName,LastWriteTime

Recommended Actions

• Government, diplomatic and defence-adjacent organisations running on-prem Exchange should run a compromise assessment using the published IOCs.
• Keep Exchange fully patched and on supported builds. Enable AMSI integration and Extended Protection.
• Restrict administrative access to Exchange servers, enforce MFA for admins, and rotate credentials stored on the servers.
• Forward Exchange, IIS and EDR telemetry to a central SIEM so in-memory activity is visible even if local logs are cleared.
• Where possible, move highly sensitive correspondence to platforms with stronger isolation, or apply message-level encryption.

Analyst Assessment

Cereal fits Turla's long record of patient, server-side email collection. Earlier the group used malicious Exchange transport agents; now it hijacks existing handlers and keeps C2 on the victim's own server. Because there's no external infrastructure, network defences will see almost nothing, so detection depends on host integrity checks of Exchange itself. With only two confirmed victims, this is a narrowly targeted espionage tool. But the method could be reused against any foreign ministry or international organisation that still runs on-prem Exchange. Severity is rated High.