Turla's malware turns Exchange into its own C2

Turla’s new Exchange toolset, which ESET calls Cereal, reads mail off a compromised server without running any external command-and-control infrastructure. The compromised Exchange box is the only control point. Operators reach it through encrypted web requests sent to URL paths that look like legitimate Exchange services, and the stolen mail goes back out over the same channel.

ESET documented the campaign in late 2025. It first surfaced as modular .NET malware on an Exchange server at a government body in Kazakhstan. A month later the same toolset turned up at a government agency in Romania, compromised on December 23, 2025, where it was tuned to collect correspondence with representatives of NATO and the EU. Turla, also tracked as Snake, Secret Blizzard, and Waterbug, is an FSB-linked espionage group that has been running operations for more than two decades, and the target selection fits the history.

How it reads the mail

The interception component, CerealBox, injects into EdgeTransport.exe, the Exchange transport process, and hijacks the handlers of transport agents that are already registered. It does not install a transport agent of its own. That is the point: a defender auditing registered transport agents sees nothing new, and mail delivery is not interrupted. The malware executes its commands in memory and inspects message content as it passes through.

Turla configured it to be selective. It collected messages carrying document attachments, specifically .DOC, .DOCX, and .PDF files, that also matched chosen sender, recipient, and subject criteria. This is targeted collection against named correspondents, not bulk mailbox exfiltration.

The command channel

A second component, CerealNeuron, listens for incoming encrypted web requests on paths that resemble real Exchange services. When one arrives, it verifies and decrypts the request, then executes the CerealRunner program it carries. CerealRunner is a wrapper holding an encrypted .NET payload plus the arguments to run it; the payload executes in the host’s memory and returns its output to CerealNeuron, which encrypts the result and sends it back to the operators.

The commands these carriers can deliver cover most of what an espionage operator wants on a mail server: retrieve emails from Exchange, query Active Directory for users, groups, and DNS records, extract locally stored credentials, and read or delete files.

ESET found a large number of near-identical binaries, each compiled for a single task, and reads that as evidence of an internal build framework that automates compiling and packaging commands into disposable carriers. The company describes the result as a mature, well-engineered platform rather than a loose collection of scripts, built around modular, interchangeable components.

There is also a variant, CerealHermit, with no network capability. It reads its commands from encrypted files on disk, which ESET suggests is a fallback for when the web channel is unavailable. ESET did not explain how the operators place those command files on the server or retrieve the results.

For concealment, Cereal abuses the .NET native image cache to run inside legitimate processes, which ESET points to as a sign of Turla’s depth in .NET execution techniques. The toolset was built for long-term, quiet collection: small disk footprint, and infrastructure unlikely to be flagged and blocked.

What this means if you run Exchange

The no-C2 design is the practical problem. Egress monitoring and C2 blocklists do not help here, because there is no outbound beacon to a known-bad host. The malicious traffic is inbound HTTPS to your own Exchange server on paths that look routine, and the data leaves the same way. Detection has to happen on the host.

That means watching EdgeTransport.exe for injected code and in-memory modification of transport agent handlers, rather than trusting the list of registered transport agents. Unexpected entries in the .NET native image cache and unexplained in-memory .NET execution inside Exchange processes are worth hunting for on servers handling sensitive correspondence. ESET has published an extended set of indicators of compromise on its GitHub page.