ESET found Russia's Cereal toolset harvesting selected email inside two government Exchange servers, with no attacker-owned infrastructure to hunt.