A Russia-aligned state-sponsored actor known as Turla, also called Snake, is using a previously undocumented toolset named Cereal to break into Microsoft Exchange servers and collect emails. ESET says the modular espionage framework was seen against two governmental entities in Kazakhstan and Romania in late 2025.
How the Cereal toolset is described
ESET describes Cereal as a long-term cyber espionage system built to stay quiet and remain on Exchange servers. The company says it leaves little on disk, avoids outside infrastructure that could be found and blocked, and hides inside legitimate Exchange processes. It also says Exchange servers serve as mail servers, collection points, internal execution hubs, and a place to conceal .NET tradecraft.
The toolset works through interconnected components that run on Microsoft Exchange servers, accept commands, execute them in memory, map the infected network, and harvest emails of interest. The initial access method is unknown. Turla is known to use spear-phishing, watering hole attacks, and ISP-level adversary-in-the-middle attacks, but the report does not say which one was used here. The name Cereal comes from the heavy use of serialization, which converts a data structure or object state into a format that can be stored, transmitted, and reconstructed.
What each component does
ESET says the framework has eight parts that work together to reach sensitive email data. CerealRunner is deployed by the operator and can drop CerealLoader, CerealSprinter, CerealIron, and CerealMoth. CerealLoader loads and runs a .NET assembly from an encrypted file on disk, which leads to CerealSprinter. CerealSprinter works like CerealRunner and is used to decrypt and run CerealNeuron, CerealHermit, and CerealBox.
CerealIron is an injector that can load and run .NET assemblies from non-.NET processes. CerealMoth takes an assembly and a method name, loads the assembly, and runs the specified method. CerealNeuron is a passive backdoor on a compromised Exchange Server that listens for incoming web requests on paths that look like normal Exchange traffic so it can execute assemblies contained in CerealRunner binaries. CerealHermit is a CerealNeuron variant that reads commands from encrypted files on disk and has no network function of its own. CerealBox is the email-harvesting module, and it processes, filters, and collects messages by injecting itself into the Exchange transport service, EdgeTransport.exe.
Email collection and filtering
Once it can see the email flow, the malware looks for messages with DOC, DOCX, or PDF attachments. It then compares those messages against at least one of many hard-coded lists tied to sender addresses, recipient addresses, subject lines, or attachment names. Messages that pass the filter are compressed, encrypted, and staged in files on disk.
Those staged files are then exfiltrated and deleted through CerealNeuron commands. In the attack aimed at the Romanian government organization, CerealBox was configured to gather emails involving NATO and European Union institutional addresses. ESET says that pattern matches Russia’s strategic priorities. The commands are sent as compiled .NET programs, and CerealRunner unpacks and runs them in memory before sending the results back to CerealNeuron for encrypted exfiltration to the threat actor.
Command types and ESET’s assessment
The commands can retrieve mailboxes or specific messages, queue Active Directory for computers, users, groups, and DNS records, run Windows Management Instrumentation queries, extract LSA Secrets, list volume snapshots, and perform file operations. Matías Porolli, an ESET researcher, said the near-identical binaries suggest an internal framework that automates compilation and packaging of commands.
He added that the modular design and interchangeable parts make the platform look mature and well engineered rather than like a loose set of scripts.
Licensed under CC BY-ND 4.0 International