ESET finds Turla toolset hiding inside Exchange mail flow

ESET finds Turla toolset hiding inside Exchange mail flow

10 November 2026: ESET has documented a previously unknown set of .NET tools, which it calls Cereal and attributes with high confidence to the Russia-aligned group Turla, that lives on on-premises Microsoft Exchange servers and copies selected mail without ever contacting a command server. It found the tools at a government body in Kazakhstan and, a month later, at one in Romania.

Not yet independently verified. The findings, the two victims and the attribution rest on ESET's own research post; we found no statement from the Kazakh or Romanian authorities. ESET does not say how the attackers first got onto the Exchange servers, and names no CVE. We will update this when it can be confirmed, and remove this note.

A backdoor that only listens

Most implants beacon out to their operators, and those beacons are what defenders block. CerealNeuron, the main backdoor, does the opposite. It waits on the Exchange server for incoming web requests on paths that look like ordinary Outlook Web Access, Autodiscover and ActiveSync traffic, such as /owa/sdds/. A request that is correctly encrypted and passes several integrity checks is decrypted and run as a command; one that looks wrong gets a legitimate looking Exchange response, so a casual probe sees nothing odd.

A sibling, CerealHermit, has the network code removed and reads encrypted command files from disk instead. In some intrusions both were installed, giving the operators two separate ways in. Commands arrive as small CerealRunner programs, each compiled for one task and run in memory; ESET says the number of near-identical runners points to an internal framework that builds them automatically.

Copying mail from inside EdgeTransport

CerealBox is the part Exchange administrators should study. Exchange lets developers add transport agents to the mail flow, for spam filtering and the like, but an installed agent shows up in the configuration. CerealBox avoids that. It is injected into EdgeTransport.exe, the process that moves mail, finds the transport agents already there and wraps their handlers with its own code, which runs first and then hands back to the original. Mail flows normally and no new agent appears.

It keeps messages that carry a .doc, .docx or .pdf attachment and match hardcoded lists of senders, recipients, subject fragments or attachment names, then compresses, encrypts and stages them on disk for CerealNeuron to send out later. In the Romanian intrusion the lists were set to collect messages involving NATO and EU institutional addresses.

What to look for on an Exchange server

ESET gives several traces that a check of a self-hosted Exchange estate can use:

• copies of ncobjapi.dll or wbemcomn.dll in C:\Windows\System32\wbem\ that do not belong there, used to load the toolset;
• malicious files planted in the .NET native image cache under names such as Microsoft.Exchange.Search.Mdb.ni.dll, which the runtime loads in place of the genuine precompiled library before quietly falling back to the real one;
• encrypted request bodies on OWA, Autodiscover or ActiveSync paths that are answered with error pages rather than normal responses.

The full list of indicators is in ESET's malware-ioc repository on GitHub, in the turla folder. Exchange Online is not the target here: every step depends on the attacker controlling a self-hosted server.

Timeline of the two intrusions

ESET first found the toolset on 28 November 2025 at the Kazakh government body. After tuning its detection it found the Romanian government body, which it says had been compromised on 23 December 2025. Activity in Kazakhstan rose sharply on 15 January 2026. The research post went up on 10 November 2026, written by ESET researcher Matias Porolli.

Sources

• ESET Research (WeLiveSecurity): Exchange for breakfast, Turla's Cereal tricks are not for kids, 10 November 2026, 10 November 2026
• ESET malware-ioc repository, turla folder (read 11 November 2026), 11 November 2026