{"id":2204,"date":"2026-11-11T07:19:21","date_gmt":"2026-11-11T00:19:21","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-turla-cereal-exchange-gian-diep-email\/"},"modified":"2026-11-11T07:19:21","modified_gmt":"2026-11-11T00:19:21","slug":"turla-profile-cereal-exchange-email-espionage","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-turla-cereal-exchange-gian-diep-email\/","title":{"rendered":"Turla Profile: Cereal Turns Exchange Servers into Email Espionage Hubs"},"content":{"rendered":"

Turla<\/strong>, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 c\u00f3 li\u00ean h\u1ec7 v\u1edbi Nga, \u0111\u00e3 ph\u00e1t tri\u1ec3n b\u1ed9 c\u00f4ng c\u1ee5 Cereal \u0111\u1ec3 \u1ea9n s\u00e2u trong Microsoft Exchange, thu th\u1eadp email ch\u1ecdn l\u1ecdc v\u00e0 d\u00f9ng ch\u00ednh m\u00e1y ch\u1ee7 c\u1ee7a n\u1ea1n nh\u00e2n l\u00e0m h\u1ea1 t\u1ea7ng \u0111i\u1ec1u khi\u1ec3n. Ph\u00e1t hi\u1ec7n m\u1edbi c\u1ee7a ESET cho th\u1ea5y m\u1ed9t chi\u1ebfn d\u1ecbch ki\u00ean nh\u1eabn, am hi\u1ec3u s\u00e2u Exchange v\u00e0 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 gi\u1ea3m t\u1ed1i \u0111a d\u1ea5u v\u1ebft m\u1ea1ng.<\/p>\n

Who is Turla?<\/h2>\n

Turla, also known as Snake, Uroburos, and KRYPTON, has operated since at least 2004. It typically targets governments, diplomatic missions, and defense organizations across Europe, Central Asia, and the Middle East. ESET says about 70% of the countries targeted by Turla since 2022 have been former Soviet republics or European countries once closely aligned with the Soviet Union.<\/p>\n

A trail from Kazakhstan to Romania<\/h2>\n

On November 28, 2025, ESET discovered the previously undocumented toolset on an Exchange server at a Kazakh governmental organization. After refining detection, researchers found the same toolset at a Romanian governmental organization compromised on December 23, 2025. In Romania, Cereal was configured to identify messages sent to or received from NATO and European Union addresses.<\/p>\n

\"Diagram
Components of the Cereal toolset. Source: ESET Research.<\/figcaption><\/figure>\n

A modular malware ecosystem<\/h2>\n

Cereal is not a single backdoor. CerealLoader loads a .NET assembly from an encrypted file; CerealRunner and CerealSprinter package and deliver commands; CerealNeuron waits for inbound network requests; CerealHermit reads encrypted commands from disk; CerealIron supports code injection; and CerealBox filters and copies email inside Exchange's transport service. Most payloads are decrypted at runtime and executed in memory.<\/p>\n

Using the victim server as C&C<\/h2>\n

A key distinction is that ESET observed no external command-and-control infrastructure. CerealNeuron passively waits for requests on paths resembling OWA, Autodiscover, or ActiveSync. When a request passes integrity and decryption checks, its payload runs; invalid requests are redirected to a legitimate-looking Exchange error page. This blends malicious traffic with normal mail services and reduces the value of blocking domains or IP addresses.<\/p>\n

CerealBox steals email without disrupting mail flow<\/h2>\n

CerealBox is injected into the Exchange mail transport process, wraps handlers already loaded in memory, and examines email before returning control. It can filter by sender, recipient, subject, filename, and attachment type; matching messages are copied, compressed, encrypted, and staged for later collection. The original email continues to its destination, making the activity difficult for users to notice.<\/p>\n

.NET techniques point to a mature capability<\/h2>\n

The toolset abuses uncommon mechanisms such as Vtable Fixups to run native code before the normal .NET path, DLL side-loading in Windows directories, and the .NET native image cache. Commands arrive as small .NET programs compiled for individual tasks such as querying Active Directory, extracting LSA Secrets, listing processes, reading files, or accessing mailboxes. The consistent design suggests an internal framework automating command compilation and packaging.<\/p>\n

Impact and signals defenders should monitor<\/h2>\n

The campaign demonstrates that on-premises Exchange remains a high-value intelligence target: one foothold can expose email, identities, and internal network structure. Defenders should compare ESET's technical indicators, hunt for unusual assemblies in Exchange processes, inspect changes in WMI and .NET native image cache directories, and review rare requests to OWA, Autodiscover, and ActiveSync. Patching, reducing internet exposure, separating administrative privileges, and collecting process-level telemetry should be combined.<\/p>\n

Lessons from the Turla profile<\/h2>\n

Cereal reflects Turla's long-term strategy: prioritize stealth, reuse trusted infrastructure, and engineer tools closely around the target. Organizations running Exchange cannot rely only on outbound connection monitoring; they must watch process integrity, loaded assemblies, and mail flow. Attribution should also be read with its confidence level: ESET attributes Cereal to Turla with high confidence based on a concurrently used known component and conceptual similarities to earlier malware.<\/p>\n

VNCyberS<\/strong> compiled from ESET Research, BleepingComputer, and The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Turla, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 c\u00f3 li\u00ean h\u1ec7 v\u1edbi Nga, \u0111\u00e3 ph\u00e1t tri\u1ec3n b\u1ed9 c\u00f4ng c\u1ee5 Cereal \u0111\u1ec3 \u1ea9n s\u00e2u trong Microsoft Exchange, thu th\u1eadp email ch\u1ecdn l\u1ecdc v\u00e0 d\u00f9ng ch\u00ednh m\u00e1y ch\u1ee7 c\u1ee7a n\u1ea1n nh\u00e2n l\u00e0m h\u1ea1 t\u1ea7ng \u0111i\u1ec1u khi\u1ec3n. Ph\u00e1t hi\u1ec7n m\u1edbi c\u1ee7a ESET cho th\u1ea5y m\u1ed9t chi\u1ebfn d\u1ecbch ki\u00ean […]<\/p>\n","protected":false},"author":2,"featured_media":2203,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[118,784,1108,1109,1110,1094,201,508,1107],"class_list":["post-2204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt","tag-bao-mat-email","tag-cereal-malware","tag-cerealbox","tag-cerealneuron","tag-eset-research","tag-gian-diep-mang","tag-microsoft-exchange","tag-turla"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2204"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2204\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2203"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}