A Russia-linked spy group has been running a new toolkit inside Microsoft Exchange servers at two government bodies, picking out emails with documents attached as they pass through and saving copies for later collection. Security firm ESET calls the kit Cereal and ties it to Turla, a group thought to be part of Russia’s FSB.
The kit never calls out to its operators. They come to it, through web addresses on the victim’s own mail server that sit beside the ones Outlook on the web, Autodiscover and phone sync use. That leaves no outside control server for a firewall to block or a takedown to hit.
ESET’s white paper, dated 10 November, puts the first compromise at a national government organisation in Kazakhstan, from at least 28 November 2025. A Romanian government body followed from at least 23 December. The operators became busier on 15 January 2026 in Kazakhstan and on 20 January in Romania. The first date is the day after Old New Year, which ESET suggests may mean they had been on holiday. It could not work out how they got in, only that both servers were reachable from the internet, so an exploited flaw is possible. Nor could it trace the addresses the operators connected from.
Mail is collected by a piece called CerealBox. It lives inside EdgeTransport.exe, which is where Exchange moves every message in and out. Exchange lets add-ons called transport agents inspect each message, and Turla’s older LightNeuron backdoor installed one of its own. CerealBox installs nothing. It wraps the agents already running in memory, looks at each message, then hands it on to the original agent, so mail keeps flowing as normal. ESET says injecting into this service had not been documented for any malware before.
CerealBox is choosy. Word and PDF files are what it is after: mail with no .doc, .docx or .pdf attached is let through untouched. Mail with one is saved when the sender, a recipient, the subject line or the file’s name is on a list built into the tool, unless a second list tells it to ignore the message. ESET is withholding the lists because they would identify the victims, but says they include nato.int and europa.eu addresses and, in Romania, a small number of people tied to government work with those bodies. The lists are fixed inside each build, so changing targets means delivering a new one. Matches are compressed, encrypted and written to a file on the server, with a new file started once one passes 5 MB. The operators later read those files and delete them. CerealBox stops processing mail 70 days after its first run.
The backdoor that lets them in, CerealNeuron, has no commands of its own. Each order arrives as a small program that runs in memory, and ESET collected thousands of them. Those it saw pull every message from a chosen mailbox, fetch single messages with their attachments, query Active Directory for users, computers and groups, list running processes and network connections, and read stored secrets from the Windows registry. A sibling, CerealHermit, takes its orders from encrypted files on disk instead.
Only the loader is ever saved to disk as a recognisable program. The operators placed it in the .NET native image cache under the names of Exchange components, or beside Windows’ WMI service under the name of a system library, so that legitimate processes load it. The earliest copy ESET found was uploaded to VirusTotal from Kazakhstan in May 2022, though it cannot say when the kit was first used.
ESET bases the Turla link on a known Turla loader found alongside the new tools and on CerealNeuron’s likeness to Neuron, a backdoor the UK’s NCSC tied to the group in 2017. Former Soviet republics and their old European allies make up roughly seven in ten of the countries Turla has gone after since 2022, on ESET’s figures. Kazakhstan began deporting some Russian exiles in January, and ESET reads that case as consistent with an interest in dissidents.
For administrators running Exchange on their own servers, the paper lists file hashes, the file names the loader used and the matching MITRE ATT&CK techniques.
