Turla’s Cereal methods usually are not for youths

On a compromised Trade server, probably the most fascinating exercise shouldn’t be at all times the message that arrives in a consumer’s inbox.

Someplace in a nationwide authorities workplace, an official sends an electronic mail to a colleague at a transnational army alliance. The message goes out by way of a Microsoft Trade server, precisely because it ought to, and nothing seems to be suspicious. However earlier than the e-mail leaves the constructing, a chunk of code quietly examines it, decides that it’s fascinating, and units apart a replica to be forwarded to prying eyes, whereas the unique electronic mail continues on its manner.

On November 28^th, 2025, we discovered the toolset that installs such code on an Trade server of a governmental group in Kazakhstan. What initially regarded like separate suspicious elements quickly revealed a beforehand undocumented toolset: a group of modular .NET malware designed to run on Microsoft Trade servers, obtain instructions, execute them in reminiscence, map the compromised group, and acquire chosen electronic mail messages. After fine-tuning our detections, we discovered the identical toolset at a governmental group in Romania – compromised on December 23^rd, 2025 – the place it was configured to determine emails despatched to, or acquired from, The North Atlantic Treaty Group (NATO) and European Union (EU).

As a result of the instruments rely closely on serialization (a way for packaging knowledge and code for transport), we have now given them names that begin with the prefix “Cereal”. What makes this toolset stand out is its mixture of novel methods requiring deep data of Trade internals with uncommon .NET execution strategies.

One of the vital fascinating elements of this toolset is what we did not discover: exterior command and management (C&C) infrastructure. As an alternative – including insult to harm – the sufferer’s compromised Trade server is co-opted to behave because the C&C infrastructure.

We attribute Cereal, with excessive confidence, to the Russia-aligned APT group Turla, based mostly on the concurrent use of one other part publicly linked to Turla and conceptual similarities to older Turla malware. The complete technical evaluation is accessible in our white paper.

Key factors of this blogpost:

• We initially noticed an undocumented toolset at a governmental group in Kazakhstan. After fine-tuning our product’s detection of those instruments, we found a compromised governmental group in Romania a month later.
• We uncovered a classy, modular, and tightly interconnected toolset, designed to run on Trade servers of compromised entities, for long-term cyberespionage.
• No exterior community infrastructure was noticed. One of many malicious elements, a passive backdoor that runs on Trade servers, supplies entry to the interior community.
• Instructions are despatched by the operators within the type of separate executables with an analogous, custom-built construction. This hints on the existence of a framework that automates compilation and supply of instructions.
• An automatic electronic mail assortment module, injected into authentic Microsoft Trade processes, accesses and manipulates the e-mail transport pipeline. This requires deep understanding of the internal workings of Microsoft Trade and is a novel method.
• Using varied .NET methods, resembling unmanaged entry factors, and abuse of the .NET native picture cache makes this toolset fairly subtle compared to most up-to-date APT circumstances that we have now researched.

Victimology and geopolitical context

Turla, also referred to as Snake, has been energetic since at the least 2004 and is broadly assessed to be a part of Russia’s Federal Safety Service (FSB). Its common targets are governments, diplomatic missions, and protection organizations, primarily throughout Europe, Central Asia, and the Center East. We’ve got documented a big a part of Turla’s arsenal on WeLiveSecurity. In 2025, we additionally reported uncommon cooperation between Turla and Gamaredon in our blogpost Gamaredon X Turla collab and in our white paper Gamaredon in 2025: Leveraging tunnels, employees, useless drops, and new alliances.

The Cereal toolkit demonstrates Turla’s capability to hold out a gradual, cautious, long-term intrusion constructed round Microsoft Trade servers.

We recognized two nationwide governmental organizations compromised by Cereal, in geographies that align carefully with Turla’s identified focusing on. Based mostly on ESET telemetry, round 70% of nations focused by Turla since 2022 have been former Soviet republics or European nations that have been as soon as carefully aligned with the Soviet Union. The geographic distribution of the 2 confirmed compromises is proven in Determine 1.

The Romanian case is notable as a result of one part, CerealBox, was configured to gather messages involving NATO and EU institutional addresses. This focus matches long-standing Russian intelligence priorities. It could additionally relate to regional tensions: since early 2025, Romania has reported a number of incidents involving Russian drones crashing close to or inside its territory, prompting robust reactions from Romanian authorities and requires a NATO mission within the Black Sea area.

The Kazakh compromise additionally occurred in a related political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had beforehand discovered relative security there after Russia’s full-scale invasion of Ukraine. Compromising a Kazakh governmental physique matches a situation during which the operators need visibility into Russian dissidents identified to Kazakh authorities however not but on any deportation record.

There may be another element value noting. Exercise in Kazakhstan surged on January 15^th, 2026 – the day after the Previous New Yr, an off-the-cuff vacation nonetheless noticed in Russia and a few neighboring nations. Whereas malware doesn’t have a good time holidays, its operators do.

Tracing the Cereal crumbs

The primary elements we discovered didn’t resemble a traditional backdoor. There was no apparent monolithic implant, no built-in command record, and no easy beaconing sample. As an alternative, the exercise appeared as a series of specialised elements: encrypted payloads on disk, .NET assemblies embedded inside different .NET assemblies, authentic Home windows processes loading suspicious DLLs, and Trade providers executing code that didn’t belong there.

Reconstructing that chain revealed a modular toolset constructed round a number of recurring design ideas: preserve payloads encrypted, preserve execution in reminiscence every time doable, reuse the compromised Trade server, and ship instructions as separate .NET assemblies. Determine 2 reveals the relationships between all the noticed elements of the toolset.

Primary elements are:

• CerealLoader, which masses and runs a .NET meeting from an encrypted file on disk. That is the one part within the toolset that’s written to disk as a recognizable .NET file. The whole lot else is delivered inside encrypted containers, unpacked at runtime, and executed from reminiscence.
• CerealRunner, which accommodates different encrypted binaries which might be loaded and executed. It supplies a technique to encapsulate and ship instructions, in addition to different elements.
• CerealSprinter, which is analogous to CerealRunner, however is used solely to load and run different elements.
• CerealNeuron, a passive backdoor with no built-in instructions however able to executing assemblies contained in CerealRunner binaries, acquired in community requests; we named it in reference to Neuron, a malware household documented and attributed to Turla by the UK’s Nationwide Cyber Safety Centre in 2017, on condition that they’re functionally comparable.
• CerealHermit, a variant of CerealNeuron with no community functionalities. It reads instructions from encrypted information on disk.
• CerealIron, an injector that permits operators to load and run .NET assemblies from non .NET processes.
• CerealBox, which processes, filters, and collects fascinating electronic mail messages by being injected into Microsoft Trade’s transport service.
• CerealMoth, a easy part that receives an meeting and a technique identify as arguments, masses the meeting, and runs the required methodology.

When the sufferer’s Trade is the infrastructure

Essentially the most notable side of this marketing campaign is what we didn’t discover: an attacker-controlled server.

Most backdoors periodically contact their operators. That conduct leaves traces – domains, IP addresses, internet hosting suppliers, timing patterns – that defenders determine and block. CerealNeuron, the principle backdoor within the Cereal toolset, does none of that. As an alternative of initiating outbound connections, it waits for incoming requests.

CerealNeuron runs on the compromised Trade server and passively listens for incoming internet requests on paths that appear to be unusual Trade visitors. Among the many paths we noticed:

• https://*:443/owa/sdds/
• HTTPS://*:443/AUTODISCOVER/PROXYSERVICE/
• HTTPS://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/

To a firewall log or an analyst reviewing visitors, requests to those paths mix in with authentic Outlook Internet Entry, Autodiscover, and ActiveSync visitors. If a request for a useful resource on one among these paths is correctly encrypted and passes a number of integrity checks, CerealNeuron decrypts it, treats the contents as a command, and runs it. If a request seems to be unsuitable, CerealNeuron redirects the shopper to a legitimate-looking Trade error web page.

The results are vital:

• There isn’t any devoted C&C infrastructure to find, block, or take down. The sufferer’s personal internet-facing Trade server is the operator-accessible management level.
• Community-based monitoring is severely restricted. We have been unable to determine the ingress IP addresses utilized by the operators. They could have related immediately, through anonymization providers, or from different compromised hosts.
• Malicious visitors coexists with authentic Trade internet providers – precisely the form of visitors defenders are least prone to block.

Determine 3 reveals the communication stream between operators and CerealNeuron.

Abusing a compromised Trade server as a central operational hub is a uncommon method, utilized by solely a handful of APT teams. Turla has used variations of this method previously. With Cereal, counting on the sufferer’s Trade server removes the necessity for devoted attacker infrastructure.

The toolset additionally supplies a fallback mechanism. CerealHermit is a variant of CerealNeuron with the community elements eliminated. As an alternative of ready for internet requests, it reads encrypted command information from disk and writes encrypted outcomes again. In some intrusions, each backdoors have been deployed collectively, giving operators two unbiased methods to achieve their objectives.

Instructions as disposable applications

Relatively than a single giant backdoor containing each doable command, Turla’s operators ship every command as its personal small, compiled .NET program.

The core execution part is CerealRunner. It carries different encrypted .NET applications inside itself, together with the arguments wanted to run them. When it executes, it unpacks its payloads, runs them in reminiscence, and returns their output by way of the identical pipeline so CerealNeuron can encrypt and ship it again.

We detected quite a few CerealRunner binaries throughout the 2 intrusions. They share the identical construction however differ within the small piece of code that implements every particular job.

The instructions embody:

The sheer quantity of near-identical binaries, every compiled for a particular job, strongly means that the operators have an inner framework that automates the compilation and packaging of instructions. Mixed with a codebase constructed round modular, interchangeable elements, the impression is one among a mature, well-engineered platform – fairly than a free assortment of scripts.

.NET methods that aren’t for youths

What distinguishes Cereal from most up-to-date APT circumstances is how deeply it leverages the internal workings of .NET, Microsoft’s software program framework that powers a big a part of Home windows and Trade itself.

Usually, .NET applications run by way of the Frequent Language Runtime (CLR), which converts a program’s directions into machine code simply earlier than working them. This complete course of is seen to straightforward evaluation instruments. Cereal repeatedly operates exterior these commonplace, observable paths.

A .NET program that runs native code earlier than any .NET code

CerealLoader is the one Cereal part written to disk in unencrypted kind. In a .NET decompiler, the entry level code does primarily nothing, and a breakpoint set on the malicious methodology isn’t triggered.

In observe, CerealLoader executes low-level, machine-native code earlier than the .NET runtime even begins working its regular directions. It abuses a hardly ever used function of the .NET specification, Vtable Fixups, to construct a hidden bridge from native code again right into a .NET methodology that no different a part of this system seems to name. An analyst inspecting solely the .NET aspect sees code that seems to do nothing. By that time, the actual payload has already run.

Hijacking authentic Home windows elements

As a result of CerealLoader can bootstrap itself from native code, the operators can drop it in locations the place authentic, non-.NET Home windows processes will load it. In a single execution chain, CerealLoader was positioned as ncobjapi.dll inside C:WindowsSystem32wbem, the place the Home windows Administration Instrumentation service loaded it robotically. In one other, it impersonated wbemcomn.dll in the identical folder. The malicious DLL forwards authentic operate calls, so the affected course of continues to function usually.

Abuse of the .NET native picture cache

To enhance startup efficiency, .NET retains a cache of precompiled variations of widespread libraries in a system folder. When a program asks for one among these libraries, the runtime checks the cache first and, if there’s a match, masses the cached model as an alternative of JIT-compiling the meeting’s code. The operators positioned malicious CerealLoader information on this cache, utilizing names resembling Microsoft.Trade.Search.Mdb.ni.dll. When Trade requested for the corresponding library, the runtime loaded the malicious model as an alternative. As a result of the malicious file accommodates no actual substitute code, .NET quietly falls again to the real library for precise performance – however not earlier than the attackers’ native entry level code has executed. In a single pattern, the malicious code solely prompts when the mum or dad course of is Trade’s search service.

Every of those methods is documented in lesser-known elements of the .NET specification. What’s uncommon is seeing them mixed so intentionally in a single toolset, and used particularly to cover inside Microsoft Trade.

CerealBox: hooking Trade from the within

The Cereal part that makes use of probably the most novel method is CerealBox, an electronic mail assortment module constructed for Microsoft Trade.

Turla has focused Trade servers earlier than, together with by way of the abuse of transport brokers – a authentic Trade function that lets builders hook into the stream of electronic mail for duties resembling spam filtering. Put in transport brokers, nonetheless, depart seen traces in Trade’s configuration.

CerealBox makes use of a stealthier method. As an alternative of registering itself, it’s injected immediately into EdgeTransport.exe, the Trade course of that handles electronic mail stream. Reaching that time, nonetheless, shouldn’t be simple: CerealBox is delivered by way of an intricate chain of nested Cereal elements, illustrated in Determine 4.

As soon as inside, CerealBox accesses Trade’s inner buildings, finds the prevailing transport brokers, and wraps their handlers with malicious code. The wrappers run CerealBox’s personal logic first, then hand management again to the unique code. Electronic mail continues to stream usually. No new agent seems anyplace in Trade’s configuration. Briefly: CerealBox doesn’t add a brand new agent; it hijacks present ones loaded in reminiscence.

Having visibility into the mail stream, CerealBox picks out messages of curiosity. A message qualifies if it has a .doc, .docx, or .pdf attachment and matches at the least one among a number of hardcoded lists – sender addresses, recipient addresses, topic substrings, or attachment names – whereas avoiding matching ignore lists. Attention-grabbing messages are compressed, encrypted, and staged in information on disk. Operators later use unusual CerealNeuron instructions to exfiltrate and delete these information.

Injecting into the Trade transport service and hooking mail stream from inside is a novel method, not beforehand documented for any malware household. It requires a deep understanding of how Trade’s mail pipeline is structured internally – the form of data that requires vital effort and time to amass.

Conclusion

The Cereal toolset is a fastidiously constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids exterior infrastructure that may very well be found and blocked, and conceals itself inside authentic Trade processes. Using unmanaged entry factors, VTable Fixups, native picture cache abuse, and in-memory injection into Trade’s transport pipeline displays a stage of funding in .NET tradecraft that’s unusual even amongst subtle APT actors.

The Cereal toolset demonstrates that, for Turla, Trade servers usually are not simply mail servers – they’re sturdy assortment factors, inner execution hubs, and an appropriate surroundings for hiding subtle .NET tradecraft.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis gives non-public APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IoCs

A complete record of indicators of compromise (IoCs) could be present in our GitHub repository and the Turla white paper.