Security researchers at ESET have exposed a new espionage toolset that turns a victim's own email server into a spying device. The toolset, named Cereal, was found running on Microsoft Exchange servers at government organisations in Kazakhstan and Romania, where it quietly copied selected emails, including correspondence with NATO and the European Union. ESET published its research on Tuesday, 10 November, and attributes the toolset with high confidence to Turla, the Russia-aligned hacking group widely assessed to be part of Russia's Federal Security Service.

Turla, also known as Snake, Secret Blizzard and Waterbug, has been active for more than two decades and is one of the most persistent state-backed espionage groups in operation. ESET describes Cereal as a carefully built instrument for long-term, stealthy cyberespionage, designed to sit inside a compromised organisation for months while drawing as little attention as possible.

Two governments, one toolset

ESET first found the toolset on 28 November 2025 at a government body in Kazakhstan. After refining its detections, the company found the same toolset at a government agency in Romania, which had been compromised on 23 December 2025. In both cases Cereal was configured to collect emails sent to or received from NATO and the EU, a targeting pattern ESET says fits closely with Turla's known interests.

Activity in Kazakhstan surged on 15 January 2026, the day after the Old New Year, an informal holiday still observed in Russia. ESET researcher Matias Porolli said the toolset features a novel email collection module, a unique command-and-control mechanism and sophisticated tricks for running code inside Microsoft's .NET framework.

How Cereal reads email from inside Exchange

The most remarkable component is CerealBox, which injects itself into Exchange's EdgeTransport.exe process and hijacks the handlers of existing transport agents. That lets it inspect email content as messages flow through the server, without registering a new transport agent of its own and without interrupting normal mail delivery. ESET says this way of hooking the transport service from the inside has not been documented for any malware family before.

CerealBox keeps messages that carry document attachments such as .DOC, .DOCX and .PDF files, and that match hardcoded lists of senders, recipients, subject strings or attachment names. Everything else is left alone, which keeps the theft selective and hard to notice.

A second component, CerealNeuron, is the main backdoor. It waits for incoming encrypted web requests on paths that resemble legitimate Exchange services, such as /owa/sdds/ and /autodiscover/proxyservice/. It checks and decrypts each request, then runs the supplied CerealRunner program, a wrapper carrying encrypted .NET code that executes in the host's memory and returns its output to CerealNeuron, which encrypts the result and sends it back to the attackers. Commands can retrieve emails from Exchange, query Active Directory for users, groups and DNS records, extract locally stored credentials, and read or delete files.

A third variant, CerealHermit, has no network capability at all. It reads commands from encrypted files on disk instead, giving the operators a fallback if the web channel stops working. ESET has not explained how the attackers place those command files on the server or collect the results.

Why Cereal is hard to spot

ESET observed no external command-and-control infrastructure in the attacks, leaving the compromised Exchange server itself as the only control point. The toolset has a small footprint on disk, runs its payloads in memory, and abuses the .NET native image cache to run inside legitimate processes. The sheer volume of near-identical binaries, each compiled for a specific task, suggests the operators use an internal framework that automates building and packaging commands, according to ESET.

Organisations running Microsoft Exchange should check ESET's published indicators of compromise, which the company has shared on GitHub, and review Exchange servers for unexpected transport behaviour. BleepingComputer reports the full technical detail of the Cereal components, while Help Net Security reports ESET's findings on the two government victims and the NATO and EU targeting.