# Russia-Linked Turla Group Deploys Cereal Toolset on Exchange Servers New stealthy malware turns government email servers into covert command and control hubs. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/e346493f-ee41-484a-b2d2-6295b010799d ## Sophisticated Espionage Campaign The Russia-linked threat actor Turla has deployed a new, undocumented toolset dubbed Cereal against government entities. ESET researchers identified the malware on Exchange servers in Kazakhstan and Romania. This campaign highlights a persistent focus on diplomatic and governmental organizations, consistent with the group's long-standing intelligence gathering activities since at least 2004. ## Passive Backdoor Mechanism Unlike traditional malware, the CerealNeuron backdoor does not connect to external attacker-controlled servers. It operates passively on the victim's own Exchange server, intercepting traffic through standard web paths like Outlook Web Access. This design makes the malicious activity nearly invisible to standard firewall logs, as it mimics legitimate email service traffic. ## Stealthy Data Exfiltration The CerealBox module targets email flow by injecting itself directly into the EdgeTransport.exe process. It monitors messages containing specific document formats like .doc or .pdf, filtering them based on hardcoded sender and recipient lists. Selected emails are compressed and encrypted on disk, allowing operators to collect sensitive intelligence without triggering standard configuration alerts. ## Advanced .NET Tradecraft The toolset utilizes modular .NET code that unpacks itself entirely in memory, leaving minimal traces on the disk. By abusing native image cache paths and Windows management folders, the malware disguises itself as trusted system components. This technique ensures that legitimate processes inadvertently load malicious modules, further complicating detection for security administrators. ## Geopolitical Intelligence Targets The targeting of Romanian government systems specifically to monitor NATO and European Union communications aligns with Russian strategic interests. Similarly, activity in Kazakhstan intensified following the deportation of Russian exiles in January 2026. These operations demonstrate how Turla leverages compromised infrastructure to track regional political developments and sensitive diplomatic correspondence. ## Evasion of Network Defenses Because the Cereal toolset lacks a dedicated command-and-control infrastructure, defenders cannot simply block external IP addresses to neutralize the threat. The victim's own internet-facing server acts as the primary control point. ESET researchers were unable to identify ingress IP addresses, suggesting the use of anonymization services or previously compromised host machines. ## Dual Access Methods Some victims were compromised using a secondary component called CerealHermit, which operates independently of network functions. This version reads encrypted command files directly from the disk, providing attackers with a redundant access method. This dual-layered approach ensures that even if network-based backdoors are disrupted, the operators maintain persistent control over the environment. ## Defensive Detection Challenges Organizations must look beyond standard transport agent lists, as Cereal does not register itself within Exchange configurations. Security teams should inspect the Windows management folder for unusual DLL files and monitor for suspicious requests to web paths. The Cereal toolset proves that Exchange servers are now primary targets for long-term cyberespionage. ## Sources covering this story - https://securityaffairs.com/202800/apt/russia-linked-apt-turla-turned-exchange-servers-into-their-own-control-room.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._