Researchers at ESET say the Russian cyber-espionage group Turla used a new toolset they call Cereal to intercept selected email on Microsoft Exchange servers at government organizations, BleepingComputer reported Monday¹.

ESET documented the activity in late 2025, first finding modular.NET malware for Exchange at a government body in Kazakhstan, then the same toolset at a government agency in Romania that ESET said was compromised on Dec. 23, 2025¹.

In the Romanian case, ESET said the operators selectively gathered correspondence with representatives of NATO and the European Union¹.

Turla, also known as Snake, Secret Blizzard and Waterbug, has been active for more than two decades and is linked to Russia's Federal Security Service, according to BleepingComputer's account of ESET's work¹.

ESET said a component named CerealBox injects into Exchange's EdgeTransport.exe process and hijacks existing transport-agent handlers, executing commands in memory so it can inspect mail without registering a new agent or interrupting delivery¹.

The malware was configured to collect messages with document attachments such as.DOC,.DOCX and.PDF files and to match sender, recipient and subject criteria, ESET said¹.

Another component, CerealNeuron, waits for encrypted web requests on paths that resemble legitimate Exchange services, decrypts them and runs a wrapper called CerealRunner that carries attacker code in memory¹.

ESET said those commands can retrieve mail from Exchange, query Active Directory, extract locally stored credentials, and read or delete files¹.

The company said it observed no external command-and-control infrastructure, leaving the compromised Exchange server as the control point¹. A related variant, CerealHermit, lacks network capabilities and reads commands from encrypted files on disk; ESET did not explain how those files are placed or how results are retrieved¹.

ESET described Cereal as built for long-term, stealthy espionage with a small disk footprint and published indicators of compromise on GitHub¹. WhatsNewPaper has not independently verified ESET's attribution or the scope of the compromises¹.