Russia-Linked Spies Turned Exchange Servers Into Their Own Command Post. Layered Defenses Still Beat Any Single Product
ESET says Russia’s Turla group used a new modular toolkit called Cereal to hide inside Microsoft Exchange servers at government bodies in Kazakhstan and Romania, quietly copying selected emails with no outside command server. Here is how it worked, step by step, and the layers that defend an on-premises mail server.
Here Is How Layered Defenses Protect the Mail Server Attackers Want to Live On
Most malware has to phone home, and that call is often how it gets caught. A new toolkit attributed to one of Russia’s longest-running espionage groups was built to avoid the call entirely. It turns a victim’s own Microsoft Exchange server into the place where commands arrive, run and leave, while email keeps flowing normally.
The walkthrough below is based on BleepingComputer’s report on ESET’s research, with added detail from The Hacker News.
Who and where
ESET attributes the activity to Turla, a group also tracked as Snake, Secret Blizzard and Waterbug, which has been active for more than two decades and is linked to Russia’s FSB security service. ESET first found the toolkit, which it named Cereal because of its heavy use of data serialization, on Exchange at a government body in Kazakhstan in late 2025. After refining its detections, it found the same tools a month later at a Romanian government agency compromised on December 23, 2025.
How the attack worked, step by step
- Getting in. How Turla first reached the Exchange servers is unknown. The group has a history of spear-phishing, watering-hole websites and adversary-in-the-middle attacks at the internet-provider level.
- Unpacking the kit. Operators deploy a component called CerealRunner, which drops the rest. Loader and injector pieces (CerealLoader, CerealSprinter, CerealIron and CerealMoth) decrypt .NET code from disk and run it inside other processes, keeping little in plain sight.
- Opening a hidden door. CerealNeuron sits quietly on the Exchange server and waits for encrypted web requests sent to addresses that look like ordinary Exchange traffic. A backup variant, CerealHermit, takes its orders from encrypted files on disk instead of the network.
- Running disposable commands. Each instruction arrives as its own small compiled .NET program, runs in memory and returns its output. ESET found so many near-identical, single-purpose binaries that it believes the operators use an automated build system. Commands could pull mailboxes or single messages, query Active Directory for users, computers, groups and DNS records, run WMI queries, extract stored LSA secrets, list volume snapshots, and read or delete files.
- Tapping the mail stream. CerealBox injects itself into Exchange’s EdgeTransport.exe process and hijacks the handlers of transport agents that are already there, so it never registers a new agent and never interrupts delivery. It picks out messages carrying DOC, DOCX or PDF attachments that match built-in lists of senders, recipients, subjects or file names. In Romania it was set to collect correspondence involving NATO and European Union addresses.
- Leaving with the goods. Matching emails are compressed, encrypted and staged on disk, then sent out and deleted through CerealNeuron. ESET saw no outside command-and-control server at all: the Exchange server was the only control point.
ESET has published indicators of compromise on its GitHub page for defenders who want to hunt for the toolkit.
Why no single control would have been enough
This design defeats several common safeguards at once. Blocking known bad internet addresses does not help when there is no outside server. Watching for new transport agents does not help when existing ones are hijacked. Antivirus that scans files on disk has little to look at. Protection comes from stacking independent layers:
- Shrink the target. Ask whether you still need an on-premises Exchange server. Moving mail to a hosted service, such as Exchange Online or another major provider, takes a server off your plate, though the cloud tenant then needs its own hardening.
- Keep what remains current. If Exchange must stay on-premises, keep it on a supported version with every security update applied and limit which parts are exposed to the internet.
- Guard the people who can reach it. Phishing-resistant multi-factor sign-in and separate administrator accounts limit the spear-phishing route Turla is known for.
- Watch behavior, not just files. Endpoint detection and response on mail servers can flag code injected into Exchange processes, unusual .NET activity and unexpected credential access.
- Look for odd patterns. Review web logs for strange requests to Exchange paths, and alert on large mailbox exports or Active Directory queries coming from the mail server itself.
- Limit how far an intruder can go. Segment the mail server from the rest of the network and control what it is allowed to send outbound.
What this means for your company
Small and mid-size businesses are not Turla’s usual targets, but the lesson travels: a mail server is a vault of contracts, invoices and passwords, and well-funded attackers are building tools to live inside it unnoticed. If you still run Exchange in a closet or a data center, take a hard look at whether it is patched, monitored and truly necessary. If your mail is already in the cloud, make sure sign-in protections, audit logging and alerting are switched on, because an attacker who can read your email does not need malware at all.
Wondering whether your email platform, on-premises or cloud, would spot an intruder who never sends a single suspicious packet out? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
