The Russian state-backed threat group Turla has been deploying a new malicious toolset named 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations, according to cybersecurity company ESET. The attacks were documented in late 2025, initially detected at a government body in Kazakhstan.
The Cereal toolset was also found at a government agency in Romania, where it selectively gathered email correspondence with representatives of NATO and the EU. The Romanian organization was compromised on December 23rd, 2025.
Cereal is designed for long-term, stealthy cyberespionage, featuring a small disk footprint and using infrastructure that is less likely to be detected. Its components include CerealBox, which injects into Exchange's EdgeTransport.exe process, and CerealNeuron, which listens for incoming encrypted web requests to execute commands.
The malware is configured to selectively collect messages containing document attachments such as .DOC, .DOCX, and .PDF files. ESET observed that the compromised Exchange server served as the only control point, with no external command-and-control infrastructure used in the attack.
Turla, linked to Russia's Federal Security Service (FSB), has been active for more than two decades. The initial access vector used to deliver the malware remains unknown.