ESET Uncovers Cereal Malware on Exchange Servers, Targeting 2 Countries Without External C2
Updated
Updated · Computerworld · Nov 11
ESET Uncovers Cereal Malware on Exchange Servers, Targeting 2 Countries Without External C2
3 articles · Updated · Computerworld · Nov 11
Summary
Cereal turns compromised Microsoft Exchange servers into long-term espionage hubs, with ESET linking the toolkit to Russia-aligned Turla attacks in Kazakhstan and Romania.
No external command-and-control server was found; the passive backdoor waits on web paths resembling Outlook Web Access, Autodiscover and ActiveSync, letting operators use the victim server as its own command center.
A module dubbed CerealBox injects into Exchange transport processes to copy selected emails in transit, including .doc, .docx and .pdf attachments; in Romania, ESET found collection involving NATO and EU addresses.
The toolkit can also pull entire mailboxes, extract stored credentials and query Active Directory, underscoring how an internet-facing, highly privileged Exchange server can become a deep foothold inside an organization.
Researchers and outside experts said the tradecraft is unusually advanced even for APT actors and warned similar techniques could spread to criminal groups, raising pressure to retire or harden on-premises Exchange.
How did a stealthy Russian malware hijack government servers without leaving a single trace of its initial break-in?
What sensitive NATO communications were silently intercepted before this invisible espionage framework was finally exposed?
If the infected server becomes its own command center, how can defenders hunt a ghost that never calls home?
Inside Turla’s “Cereal” Attack: How Russia’s FSB Compromised Government Exchange Servers in 50+ Countries
Overview
ESET’s investigation into the 'Cereal' cyberespionage campaign began when analysts found malicious code on a Kazakh government Exchange server in late 2025. After refining their detection tools, ESET uncovered a similar breach at a Romanian agency, where attackers used the CerealBox module to intercept sensitive NATO and EU emails. In Kazakhstan, Turla’s intrusion aimed to monitor Russian dissidents ahead of deportations, with activity peaking after a major Russian holiday. The malware’s stealth relied on advanced .NET techniques, memory-only execution, and passive HTTPS backdoors, making detection difficult. ESET’s public disclosure and IoCs empowered global defenders to audit and secure their Exchange environments.