Turla Profile: Cereal Turns Exchange Servers into Email Espionage Hubs

Turla, nhóm gián điệp mạng được đánh giá có liên hệ với Nga, đã phát triển bộ công cụ Cereal để ẩn sâu trong Microsoft Exchange, thu thập email chọn lọc và dùng chính máy chủ của nạn nhân làm hạ tầng điều khiển. Phát hiện mới của ESET cho thấy một chiến dịch kiên nhẫn, am hiểu sâu Exchange và được thiết kế để giảm tối đa dấu vết mạng.

Who is Turla?

Turla, also known as Snake, Uroburos, and KRYPTON, has operated since at least 2004. It typically targets governments, diplomatic missions, and defense organizations across Europe, Central Asia, and the Middle East. ESET says about 70% of the countries targeted by Turla since 2022 have been former Soviet republics or European countries once closely aligned with the Soviet Union.

A trail from Kazakhstan to Romania

On November 28, 2025, ESET discovered the previously undocumented toolset on an Exchange server at a Kazakh governmental organization. After refining detection, researchers found the same toolset at a Romanian governmental organization compromised on December 23, 2025. In Romania, Cereal was configured to identify messages sent to or received from NATO and European Union addresses.

A modular malware ecosystem

Cereal is not a single backdoor. CerealLoader loads a .NET assembly from an encrypted file; CerealRunner and CerealSprinter package and deliver commands; CerealNeuron waits for inbound network requests; CerealHermit reads encrypted commands from disk; CerealIron supports code injection; and CerealBox filters and copies email inside Exchange's transport service. Most payloads are decrypted at runtime and executed in memory.

Using the victim server as C&C

A key distinction is that ESET observed no external command-and-control infrastructure. CerealNeuron passively waits for requests on paths resembling OWA, Autodiscover, or ActiveSync. When a request passes integrity and decryption checks, its payload runs; invalid requests are redirected to a legitimate-looking Exchange error page. This blends malicious traffic with normal mail services and reduces the value of blocking domains or IP addresses.

CerealBox steals email without disrupting mail flow

CerealBox is injected into the Exchange mail transport process, wraps handlers already loaded in memory, and examines email before returning control. It can filter by sender, recipient, subject, filename, and attachment type; matching messages are copied, compressed, encrypted, and staged for later collection. The original email continues to its destination, making the activity difficult for users to notice.

.NET techniques point to a mature capability

The toolset abuses uncommon mechanisms such as Vtable Fixups to run native code before the normal .NET path, DLL side-loading in Windows directories, and the .NET native image cache. Commands arrive as small .NET programs compiled for individual tasks such as querying Active Directory, extracting LSA Secrets, listing processes, reading files, or accessing mailboxes. The consistent design suggests an internal framework automating command compilation and packaging.

Impact and signals defenders should monitor

The campaign demonstrates that on-premises Exchange remains a high-value intelligence target: one foothold can expose email, identities, and internal network structure. Defenders should compare ESET's technical indicators, hunt for unusual assemblies in Exchange processes, inspect changes in WMI and .NET native image cache directories, and review rare requests to OWA, Autodiscover, and ActiveSync. Patching, reducing internet exposure, separating administrative privileges, and collecting process-level telemetry should be combined.

Lessons from the Turla profile

Cereal reflects Turla's long-term strategy: prioritize stealth, reuse trusted infrastructure, and engineer tools closely around the target. Organizations running Exchange cannot rely only on outbound connection monitoring; they must watch process integrity, loaded assemblies, and mail flow. Attribution should also be read with its confidence level: ESET attributes Cereal to Turla with high confidence based on a concurrently used known component and conceptual similarities to earlier malware.

VNCyberS compiled from ESET Research, BleepingComputer, and The Hacker News