Defenders hunting a nation-state intrusion normally start by finding infrastructure. ESET’s latest report on Turla gives them almost nothing of the sort.
The Russia-aligned group, widely assessed as part of the FSB, planted a modular .NET toolset on Microsoft Exchange servers at two government bodies: one in Kazakhstan, reached in November 2025, and one in Romania, compromised a month later. ESET’s verdict on the framework, which it calls Cereal, is high confidence.
The victim hosts the command server
The main backdoor, CerealNeuron, never calls home. It sits on the mail server and passively listens for web requests on paths that resemble ordinary Exchange traffic, such as Outlook Web Access and Autodiscover. A properly encrypted request passing several integrity checks is decrypted and executed; anything else receives a plausible Exchange error page.
Rows of single-purpose .NET payloads do the work: pulling mailboxes, querying Active Directory, harvesting Windows LSA secrets, reading and deleting files. Should the network route close, a fallback backdoor simply parses encrypted command files sitting on local disk.
Mail copied before it leaves the building
CerealBox goes further than the group’s earlier transport-agent abuse. Rather than registering an agent that would appear in Exchange configuration, it injects into EdgeTransport.exe and wraps handlers already loaded in memory. No new component appears, and mail keeps moving.
Messages carrying .doc, .docx or .pdf attachments are held back when they match hardcoded lists of senders, recipients, subjects and filenames, then compressed, encrypted and staged for later pickup. In Romania the filter targeted anything addressed to or from NATO and EU correspondents.
ESET could not recover a single operator IP address. Detection has to depend on Exchange host integrity, transport-process anomaly monitoring and memory inspection, not blocklists.
