Russia’s Turla Turned Government Exchange Servers Into Its Own Spy Hub, Copying NATO and EU Emails Without Breaking Mail Flow

Most malware has to phone home. It reaches out to a server the attackers control, and that outbound traffic is what defenders hunt for and block. A new toolset uncovered by ESET skips that step entirely. Instead of building its own command server, it turns the victim’s own Microsoft Exchange server into one, then quietly copies selected emails out of the mail flow while every message still reaches its inbox on time.

According to ESET’s research write-up published Tuesday, the toolset, which the company named Cereal, was found at two national government organizations, one in Kazakhstan and one in Romania. ESET attributes it with high confidence to Turla, a Russia-aligned espionage group also known as Snake that is widely assessed to be part of Russia’s FSB. In Romania, the email collection module was set up to flag messages sent to or received from NATO and European Union addresses.

What ESET Found Inside Two Government Mail Servers

ESET first spotted the tools on November 28, 2025, on an Exchange server at a Kazakh government body. After refining its detections, the company found the same kit about a month later at a Romanian government organization that had been compromised from December 23, 2025. The researchers say they could not determine how the attackers first got in, but note in their white paper that because the servers face the internet, exploitation of a vulnerability is one possibility. Turla is also known for spear-phishing, watering hole attacks and network-level interception, The Hacker News reported.

The name comes from the toolset’s heavy use of serialization, a way of packaging code and data so it can be moved and rebuilt later. ESET counted eight interlocking components, most of them .NET programs that are decrypted and run in memory and never written to disk in readable form. Only one piece, a loader, sits on disk as a recognizable .NET file, and even that one is built to look like it does nothing when an analyst opens it.

The Victim’s Server Becomes the Attacker’s Server

The most unusual detail is what ESET did not find: any outside command-and-control infrastructure. The main backdoor, CerealNeuron, waits for incoming web requests on paths that look like normal Outlook Web Access, Autodiscover and ActiveSync traffic. If a request is properly encrypted and passes several integrity checks, the malware runs it as a command. If not, the visitor sees an ordinary-looking Exchange error page.

That design has real consequences for defenders. There is no attacker domain or IP address to block or take down, and ESET says it could not identify where the operators were connecting from. The malicious traffic is mixed in with the email traffic that companies are least willing to block. A second backdoor, CerealHermit, offers a fallback that reads encrypted command files from disk with no network activity at all.

Commands arrive as small, single-purpose .NET programs. ESET lists jobs such as pulling mailboxes, querying Active Directory for users, computers, groups and DNS records, running system queries, extracting stored Windows credentials known as LSA secrets, and reading or deleting files. Researchers saw so many near-identical command binaries that they believe Turla runs an internal framework that builds them automatically.

A Novel Way to Read Email in Transit

Turla has abused Exchange transport agents before. These are legitimate plug-ins that hook into mail flow for tasks like spam filtering, but a newly registered agent shows up in Exchange’s configuration. The new email module, CerealBox, avoids that trace. It injects itself into EdgeTransport.exe, the process that moves mail, and wraps the handlers of transport agents that are already loaded in memory. Mail keeps flowing normally and no new agent appears, Help Net Security explained.

CerealBox keeps only messages carrying .doc, .docx or .pdf attachments that also match hard-coded lists of senders, recipients, subject lines or file names. Those emails are compressed, encrypted and staged on disk until the operators collect and delete them. ESET says hooking Exchange’s transport service from the inside in this way has not been documented for any malware family before. The loader also hid in places Windows trusts, posing as files in the system’s WMI folder and in the .NET native image cache, BleepingComputer and ESET reported.

Why This Matters for Businesses, Not Just Governments

The confirmed victims are government agencies, and Turla’s interest in NATO and EU mail is a geopolitical story. But the lesson reaches any company that still runs its own Exchange server. Email is where contracts, invoices, legal advice, deal documents and password resets live. A tool that copies only the most valuable attachments, leaves delivery untouched and talks only through normal-looking mail traffic could sit inside an organization for months without anyone noticing.

Timing adds to the risk. Microsoft ended support for Exchange Server 2016 and 2019 on October 14, 2025, meaning no more public security fixes for those versions outside a paid extended program. Organizations still running them on premises are operating internet-facing mail servers that are harder to keep patched, which is exactly the kind of system ESET suspects may have been the way in.

Practical steps for IT and security teams include:

• Know your mail footprint. Inventory every Exchange server, its version and patch level, and plan a move to a supported release or a hosted service.
• Hunt beyond the inbox. Review processes, loaded modules and file paths on Exchange hosts, including the .NET native image cache and system folders, and compare them against ESET’s published indicators of compromise.
• Watch inbound web traffic. Unusual requests to OWA, Autodiscover or ActiveSync paths deserve the same scrutiny as suspicious outbound connections.
• Limit the blast radius. Protect high-value accounts, rotate credentials after any suspected compromise, and keep sensitive documents in systems with tighter access controls than email.

The Bottom Line

Cereal shows that well-funded attackers are learning to live inside the most trusted parts of a network instead of fighting their way out of it. In ESET’s announcement, ESET described the toolset as built for long-term, stealthy espionage. For business leaders, the takeaway is simple: a mail server that delivers every message correctly is not proof that it is clean. Patching, monitoring and migration plans for on-premises Exchange belong on this quarter’s agenda.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous