ESET has disclosed Cereal, a modular espionage toolkit used on compromised Microsoft Exchange servers, and attributes it with high confidence to the Russia-aligned Turla group.
The November 10 research describes earlier intrusions: ESET found the toolkit in a Kazakh government organization on November 28, 2025, and identified a Romanian government compromise dated December 23, 2025. In Romania, collection rules targeted messages involving NATO and EU addresses.
CerealBox, its email collection module, runs inside Exchange’s transport process. It intercepts existing handlers, selects messages matching predefined criteria, and stages encrypted copies for retrieval while normal delivery continues. A passive backdoor receives commands through Exchange-looking web requests; ESET observed no external command infrastructure.
Defenders should use ESET’s published indicators and investigate unexpected code inside Exchange processes. Reviewing registered transport agents alone can miss this technique because CerealBox hijacks handlers in memory. The report describes post-compromise tooling without establishing an initial entry route.
