Actively exploited Security news
Turla's new Cereal toolset hides inside Exchange to steal government email
On 10 November 2026 ESET Research described Cereal, a previously undocumented modular toolset that it attributes to the Russia-aligned Turla group with high confidence. It sat on Exchange servers of national government bodies in Kazakhstan and Romania, filtered mail inside the transport service and took commands through ordinary-looking HTTPS requests – with no external command server at all.
Key points
- ESET found Cereal at a government organisation in Kazakhstan (identified 28 November 2025) and, a month later, at a Romanian government organisation (compromised 23 December 2025). It attributes the toolset to Turla with high confidence.
- The CerealBox module is injected into the Exchange transport service (EdgeTransport.exe) and hooks existing transport agents, so no new agent shows up in Exchange configuration. In Romania it was set to collect mail to or from NATO and EU addresses.
- There is no external command server: the CerealNeuron backdoor waits for encrypted requests on three Exchange-like URL paths, and invalid requests get a legitimate-looking Exchange error page.
- ESET does not say how the servers were first compromised and names no CVE. Since 11 November its IoC repository lists SHA-1 hashes for 18 Cereal files – copy them below; ESET has published no network indicators.
What happened
On 10 November 2026 ESET Research published an analysis of Cereal, a modular toolset built for long-term espionage on Microsoft Exchange servers. ESET first spotted it at a government organisation in Kazakhstan, where it identified the toolset on 28 November 2025. After tuning its detections it found a compromised Romanian government organisation about a month later; that compromise dates to 23 December 2025. Activity in Kazakhstan surged again on 15 January 2026.
ESET attributes Cereal to Turla (also known as Snake), a Russia-aligned espionage group, with high confidence. It bases this on a component running at the same time that has been publicly linked to Turla, and on similarities with older Turla tools. Turla has abused Exchange before – ESET documented its LightNeuron transport-agent backdoor in 2019.
How Cereal works
The toolset consists of several cooperating parts:
| Component | Role (per ESET) |
|---|---|
| CerealLoader | .NET loader; the only part written to disk as a readable, unencrypted .NET file |
| CerealNeuron | passive backdoor without built-in commands; runs what it receives in requests |
| CerealHermit | offline variant reading encrypted command files from disk; sometimes deployed alongside CerealNeuron as a fallback |
| CerealRunner / CerealSprinter | carry encrypted programs, unpack and run them in memory |
| CerealIron | injector that runs .NET code inside non-.NET processes |
| CerealBox | email filter injected into the Exchange transport service |
| CerealMoth | loads an assembly and runs a chosen method |
Getting loaded. ESET saw loader code in ncobjapi.dll and a fake wbemcomn.dll placed in C:\Windows\System32\wbem\, where the WMI service loads them automatically; the fake DLL forwards calls to the real functions. Another copy hid in the .NET native image cache as Microsoft.Exchange.Search.Mdb.ni.dll and, in one sample, only activated inside the Exchange search service. The code uses unmanaged entry points and vtable fixups so it runs without anything visibly calling it.
Stealing mail. CerealBox doesn't install its own transport agent. It wraps the handlers of agents already loaded in EdgeTransport.exe, runs its own logic first and then lets mail flow normally. It keeps a message only if it has a .doc, .docx or .pdf attachment and matches hard-coded lists of senders, recipients, subject words or attachment names. In Romania the lists targeted mail to or from NATO and EU addresses. Matches are compressed, encrypted and staged on disk.
Taking orders. There is no beaconing and ESET saw no external infrastructure. CerealNeuron waits for encrypted requests on three paths of the internet-facing Exchange server and sends anything that fails its checks to a normal-looking Exchange error page. Commands seen by ESET read mailboxes through Exchange Web Services, query Active Directory (computers, users, groups, DNS records), run WMI queries, extract LSA secrets, list volume snapshots and manage files.
Who is affected
ESET confirms victims only at national government organisations in Kazakhstan and Romania. The techniques work on any on-premises Exchange server, and ESET notes Turla's usual targets are governments, diplomatic missions and defence. ESET does not say how the attackers first got in and names no CVE.
How to tell if you were compromised
ESET has published no domains or IP addresses – Cereal uses no external infrastructure. File names and paths from ESET's post:
C:\Windows\System32\wbem\ncobjapi.dll
C:\Windows\System32\wbem\wbemcomn.dll
Microsoft.Exchange.Search.Mdb.ni.dll (in the .NET native image cache)
/owa/sdds/
/autodiscover/proxyservice/
/microsoft-server-activesync/integrated/api/ESET has added SHA-1 hashes for 18 Cereal files, with its detection names, to its IoC repository on GitHub (turla folder, samples.sha1). We checked them on 11 November 2026; they match across the README and the hash list. Note that the files reuse the names of genuine Exchange and Windows libraries, so the hash is what counts, not the name.
4A3C263977417FB6977B0E598C9E3BC5924F390C Microsoft.Exchange.Data.Transport.ni.dll CerealLoader (MSIL/Agent.YCC)
7742C6B0AAF114335CEF7EBAB11290CB18A0B8B3 version.dll CerealLoader (MSIL/Agent.YCC)
AFE448DD95494CD14438F04F0C5F6B384664A3B7 version.dll CerealLoader (MSIL/Agent.YCC)
4A65040646E354303F067D47AA1C953D467F65CB Microsoft.Search.Platform.dll CerealLoader (MSIL/Agent.YCA)
D1E17520A2435EDCDCC47F582381416FBDF75F94 Microsoft.Ceres.dll CerealLoader (MSIL/Agent.YCA)
7AB784D0049890D9844AEE7F214BA173E3CC23BE wbemcomn.dll CerealLoader (MSIL/Agent.YCA)
5D80118B1EE974936322475F740AB3AEFF70B8F3 EdgeTransport.ni.exe CerealLoader (MSIL/Agent.YCC)
D51C58C2E95D4561848E0A5A8B9FB33C847C50A4 iph.dat CerealLoader (MSIL/Agent.YCA)
5B94FE76EC4FEB0B5CB6EA3BCA4C48D2FE22597B ncobjapi.dll CerealLoader (MSIL/Agent.YCA)
1408A8F62B09A5AD0DFF279B2878D8F59F70A330 Microsoft.Exchange.Search.Mdb.ni.dll CerealLoader (MSIL/Agent.YCC)
3D1A534CE0D0C293F62ECE556CBC6D0728213104 Microsoft.Exchange.EdgeSyncSvc.ni.exe CerealLoader (MSIL/Agent.YCC)
AD85FBF2CC879D4325BCE1E6FB5F12AB59E3D387 - CerealRunner (MSIL/Agent.YBZ)
3EA03188DBA8898D97E965732C1D6A68C5437EDC - CerealSprinter (MSIL/Agent.YBZ)
3FBA18AF966DEACF7AE09E4D4238952DD90A6D6F - CerealHermit (MSIL/Agent.YBZ)
EB9BA1DA5363F5D04E2F98673595FCE93F39A78E - CerealIron (MSIL/Agent.YBZ)
0B4E4A1CE7FEE91BFC62B2A2EC572C325642BB60 - CerealMoth (MSIL/Agent.YBZ)
A4E477CE257F2C635401EF554E05506C080967C0 - bootstrapper DLL (x86) (Win32/Agent.AIOQ)
A5BE8706032A0798FD63214A9F22EFA6309355F5 - bootstrapper DLL (x64) (Win32/Agent.AIOQ)Our suggestions for hunting, based on ESET's description (not ESET's own checklist):
- Look for the two DLL names in
System32\wbemand check their signatures and hashes against a known-good Exchange server of the same build. - Look for
Microsoft.Exchange.Search.Mdb.ni.dllin the native image cache and treat any unsigned or unexpected copy as suspicious. - Search IIS logs for requests to the three paths above. ESET says the traffic mimics legitimate Exchange use, so a hit is a lead, not proof.
- Watch for code injection into
EdgeTransport.exeand for new encrypted or archive-like files appearing on the Exchange server. - Remember that an unchanged
Get-TransportAgentlist proves nothing here.
Our IOC extractor turns logs and reports into clean lists, and the hash calculator helps compare DLLs. Both run only in your browser.
What to do
- Hunt now if you run on-premises Exchange in government, diplomacy or defence, especially in Central and Eastern Europe or Central Asia.
- If you find traces, treat the domain as compromised. Cereal extracted LSA secrets and queried Active Directory, so rotate service and privileged account credentials and rebuild the Exchange server rather than cleaning files.
- Assume mail was read. Work out which mailboxes and attachments could have been exposed and notify your national CERT.
- Reduce exposure: keep Exchange on a supported, fully patched build and limit which Exchange endpoints are reachable from the internet.
Timeline
Updates
- 12 November 2026 – Romania's intelligence service SRI confirmed in a press statement on 11 November an attack on an unnamed national government institution: its National Cyberint Center detected it in December 2025, deployed countermeasures, and the email service has been cleaned up. According to SRI the attackers exploited "a series of systemic vulnerabilities in Microsoft operating systems" (no CVEs given). SRI found no exfiltration of sensitive data. The statement responds to public reporting about Turla but does not itself attribute the attack. SRI shared its findings with EU and NATO partners.
- 11 November 2026 – added SHA-1 hashes for 18 Cereal files from ESET's malware-ioc repository (How to tell if you were compromised).
- 10 November 2026 – first version of the article.
FAQ
Is there a vulnerability to patch?
ESET doesn't name one. The post does not describe how the attackers got onto the Exchange servers, so this is about finding an existing compromise, not about a single patch. Keeping Exchange fully updated is still the baseline.
Will Get-TransportAgent show the malicious module?
No. According to ESET, CerealBox doesn't register a transport agent. It wraps the handlers of agents that are already loaded in memory, so the configured agent list looks normal.
Why can't I just block the attackers' server?
There isn't one to block. The backdoor listens passively on your own internet-facing Exchange server and ESET couldn't identify the operators' source IP addresses.
Are Exchange Online mailboxes affected?
ESET describes compromised on-premises Exchange servers: files placed on disk and code injected into Exchange processes. It does not mention Exchange Online.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions
Late on 11 November 2026 ConnectWise said it is investigating unauthorized access to certain partner ScreenConnect environments, mostly managed service providers (MSPs). Its working theory is that attackers abused third-party extensions from the RMM+ family, which can run remote commands, and used them to push their own remote-access clients into customer networks. ConnectWise says it has found no vulnerability in ScreenConnect itself.
Actively exploited
Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy
On 11 November 2026 Kaspersky described Citrus, a previously undocumented Russian-speaking ransomware group. It logged in with low-privilege contractor accounts, hid its traffic in VLESS tunnels disguised as Yandex, impersonated a domain controller through an AD CS flaw patched in July and finally pushed its Go-based Sn00py encryptor to the whole domain through Group Policy.
Actively exploited
AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers
On 9 November 2026 Huntress published a deep dive into an intrusion that hit three AhsayCBS backup servers through CVE-2026-105133 and CVE-2026-105134. The flaws have been public and patched since October 2026 and are listed in CISA's KEV catalog. What's new is what the attacker left behind: five webshell families, a cryptominer, a Python implant talking to an unidentified C2, tunneling tools and theft of Veeam credentials. Patching does not remove any of it.