619/69 Wednesday, November 11, 2026
Cybersecurity researchers from ESET have disclosed a previously undocumented malware toolkit named Cereal, specifically designed to operate on Microsoft Exchange servers. The activity was first detected at a government organization in Kazakhstan in late November 2025 and was later observed at a Romanian government organization in December of the same year. Researchers attributed the campaign to the Turla APT group, also known as Secret Blizzard, Snake, and Venomous Bear, which has historically focused on cyberespionage operations targeting diplomatic and government information.
Technically, the Cereal toolkit consists of modular .NET code that is encrypted and decrypted directly in memory, leaving very few artifacts on disk. The primary component, CerealRunner, acts as a layered loader that contains, decrypts, and executes subordinate modules in sequence. Components such as CerealLoader and CerealSprinter are used to activate two types of backdoors. The first, CerealNeuron, is a passive backdoor that does not rely on an external Command-and-Control (C2) server. Instead, it turns the victim’s Exchange server itself into a command-receiving endpoint by abusing legitimate web paths such as Outlook Web Access, Autodiscover, and ActiveSync, making detection or blocking through traditional firewall controls more difficult. The second backdoor, CerealHermit, does not provide network functionality and instead reads encrypted command files directly from disk. For email theft, the attackers use a chain of modules including CerealMoth, CerealIron, and CerealSprinter to inject a data-stealing module named CerealBox into EdgeTransport.exe, the process responsible for handling email transport. This allows the malware to operate without registering a new Transport Agent, keeping it hidden from normal Exchange configuration views. CerealBox filters messages containing .doc, .docx, or .pdf attachments based on predefined senders, recipients, or keywords, then compresses, encrypts, and stages the data on disk for later retrieval. The attackers also disguise the initial loader as legitimate system files, including ncobjapi.dll, and hide components in the .NET Native Image Cache under names such as Microsoft.Exchange.Search.Mdb.ni.dll to encourage trusted processes to load the malware.
Organizations operating Microsoft Exchange servers should conduct deeper forensic checks because the toolkit is specifically designed to evade standard administrative visibility. Reviewing Exchange Transport Agents alone is not sufficient to determine whether a system is clean. Administrators should inspect Windows system management directories for unfamiliar or suspicious DLL files, review the .NET Native Image Cache for unexpected files, and monitor Exchange access logs for suspicious requests targeting Outlook Web Access, Autodiscover, and ActiveSync endpoints. These checks can help identify signs of persistence and reduce the risk of sensitive data being exfiltrated from compromised Exchange environments.