Inside Cereal: Turla Reads Government Emails from the Exchange Server Itself

Who and where

Turla (also tracked as Snake, Secret Blizzard and Waterbug) has been tied to Russia’s FSB since at least 2004. The group’s previous tooling for Exchange, LightNeuron, was documented by ESET in 2019. Cereal is the successor.

ESET attributes Cereal to Turla with high confidence, based on concurrent use of another component publicly linked to the group and conceptual similarities to LightNeuron. The researcher behind the analysis is Matías Porolli.

Two government victims are confirmed:

• Kazakhstan : ESET found the toolset on 28 November 2025. Activity surged on 15 January 2026, the day after the Old New Year holiday.
• Romania : compromised around 23 December 2025. The email filtering rules in this case targeted addresses belonging to NATO and EU institutions.

ESET’s report does not cover how the attackers reached these Exchange servers. No specific Exchange vulnerability is implicated.

Eight components, one Exchange server

Eight named components, each doing one job. The name comes from the heavy use of .NET serialization across the toolkit.

Near-identical command binaries across the two known deployments suggest Turla uses an internal automated build and packaging framework.

CerealBox: invisible email interception

Exchange transport agents are .NET classes that plug into the mail transport pipeline. They see every message as it passes through. LightNeuron, the predecessor, registered a new transport agent to intercept mail. That agent showed up in Exchange’s configuration, and that is where defenders found it.

CerealBox does not register anything.

Instead, it locates the transport agents already loaded in memory, finds their event handlers, and wraps them. When a message arrives, CerealBox’s logic runs first. If the message matches the collection criteria, it is copied. Then control passes to the original handler, and mail flow continues normally. No new agent appears in Get-TransportAgent. Exchange configuration is unchanged.

ESET says this handler-wrapping technique has not been previously documented in any malware family targeting Exchange.

Filtering criteria

A message is collected when it meets all three conditions:

1. Attachment type. The message carries a .doc, .docx or .pdf attachment.
2. Address or keyword match. At least one field (sender address, recipient address, subject line substring, or attachment filename) appears on a hardcoded inclusion list.
3. Not on the ignore list. The message is not excluded by a separate ignore list.

Collected messages are compressed, encrypted, and staged as files on disk. The operators exfiltrate them through CerealNeuron commands, then delete the staging files.

In the Romanian government deployment, the inclusion list targeted NATO and EU institutional addresses.

The server is the C2

No external command-and-control infrastructure. The compromised Exchange server is the C2.

CerealNeuron listens passively on port 443, accepting HTTPS requests at three paths designed to blend with legitimate Exchange traffic:

• /owa/sdds/
• /AUTODISCOVER/PROXYSERVICE/
• /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/

Incoming requests must pass encryption and integrity checks. Anything that fails is redirected to a legitimate Exchange error page, so a scanner just sees a normal web server.

ESET could not identify the operators’ IP addresses. They likely route through anonymisation services or other compromised hosts. No domains, IPs or hosting patterns to blocklist.

.NET tricks: VTable Fixups and native image cache

CerealLoader uses two techniques to get code running early.

VTable Fixups

The .NET spec defines VTable Fixups for exposing managed methods to native callers through COM interop. Almost nobody uses it. Cereal does.

CerealLoader declares VTable Fixup entries that bridge from native code into a .NET method before the CLR’s normal entry point runs. When a process loads the DLL, the native stub fires first. A decompiler looking at the .NET entry point sees nothing interesting. Breakpoints on the malicious managed method never trigger through normal debugging workflows because the call path skips the standard entry sequence.

DLL search order hijacking

CerealLoader places itself as ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\. The WMI service loads these automatically at boot. The malicious DLLs forward all legitimate function calls to the real libraries, so the host process keeps working. The attacker’s code has already executed by the time the service finishes initialising.

Native image cache abuse

In a second persistence path, Cereal places a malicious file in the .NET native image cache under a name like Microsoft.Exchange.Search.Mdb.ni.dll. When an Exchange process requests that library, the runtime loads the attacker’s version. The file contains no replacement code for the library itself, so .NET falls back to the genuine DLL. But the native entry point embedded in the cached file has already run.

In one sample, the code checked whether the parent process was Exchange’s search service before activating. If not, it did nothing.

What operators can do once inside

CerealRunner assemblies go well beyond email collection:

• Retrieve mailboxes and messages through Exchange Web Services
• Query Active Directory: computers, users, groups, DNS records
• Run WMI queries: processes, active TCP connections
• Extract LSA Secrets (locally stored credentials)
• List volume snapshots
• File operations: list, read, delete (especially for cleaning up CerealBox’s email dumps)

CerealHermit covers the case where network-level access to the backdoor is blocked. Operators drop encrypted command files, CerealHermit reads and executes them, writes encrypted results to a different file on disk. Slower, but it works behind a firewall that kills the HTTPS listener.

From LightNeuron to Cereal

ESET documented LightNeuron in 2019. Comparing the two toolsets shows where Turla adapted after defenders caught on.

The transport agent registration was what gave LightNeuron away. Cereal wraps instead of registering. The steganographic C2 traffic was analysable, so Cereal eliminated external C2 entirely. And where LightNeuron loaded .NET the standard way, Cereal buries execution behind VTable Fixups and native image cache entries.

Detection and hunting

ESET’s IoCs (18 SHA-1 hashes) are on GitHub. A technical white paper is available at ESET’s white paper repository.

For organisations running on-premises Exchange:

• Check C:\Windows\System32\wbem\ for unexpected ncobjapi.dll or wbemcomn.dll. These are DLL hijacking targets; the legitimate versions live elsewhere.
• Audit the .NET native image cache for .ni.dll files with Exchange-related names that do not match any installed Exchange version or cumulative update.
• Monitor HTTP logs for requests to /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/. These paths do not belong to legitimate Exchange routes. CerealNeuron uses HttpListener at the HTTP.sys level, so the requests may not appear in standard IIS logs. HTTP.sys trace logs or ETW may be needed.
• Look for compressed or encrypted temporary files being staged and then deleted near Exchange processes. This is where CerealBox parks collected email.
• Monitor for LSA Secret access originating from Exchange-related processes.
• Standard transport agent auditing will not help. CerealBox does not register an agent. Get-TransportAgent returns a clean list.

That last point matters. If your Exchange monitoring relies on checking transport agent registrations, Cereal walks past it.

Indicators of compromise

All file-based. ESET published no network indicators for Cereal (no domains, IPs, or C2 URLs).

CerealLoader (MSIL/Agent.YCC)

CerealLoader (MSIL/Agent.YCA)

Cereal components (MSIL/Agent.YBZ)

Bootstrapper DLLs (Win32/Agent.AIOQ)

Source: ESET malware-ioc repository. No CerealBox or CerealNeuron hashes are published.

Sources

• ESET — Exchange for breakfast: Turla’s Cereal tricks are not for kids (10 Nov 2026)
• ESET — Turla Cereal white paper (PDF)
• ESET — IoCs on GitHub
• Cyberscoop — Russian Turla group used new toolset to silently pilfer emails (10 Nov 2026)
• BleepingComputer — Turla hackers use new Cereal malware to spy on govt Exchange servers (10 Nov 2026)
• ESET — Turla LightNeuron: One email away from remote code execution (2019)