Imagine sending an important email, seeing that everything worked perfectly, and going about your day. Now imagine someone quietly making a copy of that message before it reaches its destination, without you or the recipient noticing anything unusual.
Sounds like something out of a spy thriller, right? Unfortunately, this is exactly the kind of operation uncovered by cybersecurity researchers at ESET.
In a report published on November 10, 2026, the company revealed a previously undocumented malware toolkit called Cereal, used in cyber espionage operations targeting government organizations in Kazakhstan and Romania.
According to ESET, the toolkit is linked with high confidence to Turla, a cyber espionage group widely associated with Russia’s Federal Security Service (FSB).
And here’s the particularly troubling part: the attackers didn’t need to shut down email services or cause obvious disruptions.
Their objective was to keep everything running normally while quietly collecting sensitive communications.
What Is Cereal Malware, and Why Is It Dangerous?
First, let’s clear something up. Cereal isn’t your typical malware that arrives in a suspicious email attachment, infects a computer, and starts displaying strange messages.
It’s a sophisticated collection of malicious tools designed to operate inside Microsoft Exchange servers, which organizations use to manage corporate email and other communication services.
Think of an Exchange server as a central mail distribution facility. Messages arrive, get processed, and are delivered to their intended recipients. Now imagine someone secretly gaining control of that facility.
Instead of breaking into individual inboxes, the attackers can potentially monitor messages moving through the system.
With Cereal, operators could also execute commands, explore internal networks, and collect information about the compromised organization. That’s a significant difference.
Accessing someone’s email account is one problem. Compromising the infrastructure responsible for handling an organization’s communications is another problem entirely.
ESET discovered that Cereal uses several interconnected components, each designed to perform specific tasks.
This modular structure allows attackers to conduct different activities without relying on one large malicious program.
How Was the Cyber Espionage Operation Discovered?
The investigation began on November 28, 2025, when ESET researchers identified suspicious components on a Microsoft Exchange server belonging to a government organization in Kazakhstan. Initially, the components appeared to be separate pieces of malicious activity.
Further investigation revealed something more sophisticated: they belonged to a coordinated malware toolkit that had not previously been documented.
After improving their detection capabilities, ESET researchers discovered the same toolkit at a Romanian government organization compromised on December 23, 2025.
The Romanian case revealed an especially interesting detail.
One malware component was configured to identify emails sent to or received from institutional addresses associated with NATO and the European Union. That distinction matters.
The investigation did not establish that NATO or EU systems themselves had been compromised.
Instead, researchers found evidence that attackers were specifically interested in communications involving those institutions.
Given the diplomatic and strategic importance of such correspondence, it’s not difficult to understand why those messages might attract attention.
And it’s certainly not the kind of attention any government organization wants.
The Attackers Used the Victim’s Own Server to Control the Operation
One of Cereal’s most unusual characteristics is how it communicates with its operators. Most malicious backdoors establish connections to external servers controlled by attackers.
Those connections can leave recognizable traces, including suspicious domains, IP addresses, and unusual network activity. Cereal took a different approach.
One component, called CerealNeuron, remained inside the compromised Exchange server and waited for incoming requests.
When a request contained properly encrypted instructions and passed the necessary checks, the malware could decrypt and execute the command.
To make detection more difficult, the attackers used web paths resembling legitimate Microsoft Exchange services.
In other words, the compromised server became part of the infrastructure used to control the attack.
Imagine someone breaking into an office building and using its own reception desk to coordinate the operation. That’s essentially the idea.
ESET did not identify dedicated external command and control infrastructure associated with the observed toolkit.
This approach made it more difficult to trace the operators’ connections and identify where their instructions originated.
How Could Hackers Copy Emails Without Anyone Noticing?
The component responsible for automated email collection was named CerealBox.
It was designed to operate directly inside the Microsoft Exchange process responsible for transporting messages.
Normally, Exchange supports legitimate tools that inspect emails for purposes such as spam filtering.
These integrations generally leave visible traces in the server’s configuration. CerealBox used a more discreet method.
Instead of registering a new integration, it modified the behavior of existing components already loaded into the Exchange transport process.
This allowed the malware to examine messages while the original email processing functions continued normally.
The component searched for messages matching criteria established by the attackers, including sender addresses, recipient addresses, subject lines, and attachment names.
Its selection process also required attachments in Word or PDF formats.
When an email matched the configured conditions, the malware compressed and encrypted a copy, temporarily storing it on the compromised server.
The attackers could later retrieve those files using other Cereal components. Meanwhile, the original message continued toward its intended recipient.
No obvious interruption. No necessarily visible warning. Just another email delivered as expected. That’s what makes this kind of espionage particularly concerning. The attack doesn’t need to announce itself to be effective.
Who Is Turla, the Group Linked to the Attacks?
Turla, also known as Snake, is a cyber espionage group that has been active since at least 2004.
The group has a long history of targeting governments, diplomatic organizations, and defense-related institutions, particularly across Europe, Central Asia, and the Middle East.
It is widely assessed to be associated with Russia’s Federal Security Service, commonly known as the FSB.
ESET attributes the Cereal toolkit to Turla with high confidence.
Researchers based this assessment on the concurrent use of another component previously linked to the group, along with similarities to older Turla malware.
However, a high-confidence technical attribution does not mean investigators have publicly identified every individual involved.
The geographic distribution of the attacks also aligns with Turla’s historical targeting patterns.
According to ESET telemetry, approximately 70% of countries targeted by Turla since 2022 were former Soviet republics or European countries historically aligned with the Soviet Union.
This provides useful geopolitical context, although it does not establish the exact motivation behind every intrusion.
Why Is Cereal Malware So Difficult to Detect?
Another important characteristic of Cereal is its ability to conceal malicious components and execute instructions directly in computer memory.
In simple terms, some parts of the attack can operate without leaving all their code stored as easily identifiable files.
The toolkit also exploits lesser-known features of .NET, Microsoft’s software development framework used by many Windows applications.
In certain cases, attackers placed malicious files where legitimate Windows or Exchange processes expected to find software components.
As a result, trusted processes could load malicious code while continuing to perform their normal functions.
Researchers also identified techniques that allowed malicious instructions to execute before conventional .NET analysis methods would normally observe them.
This doesn’t mean Cereal is impossible to detect. It means the attackers deliberately designed the toolkit to make traditional detection and analysis more challenging.
And that’s an important lesson in cybersecurity. Not every threat announces itself with a flashing warning or a system crash. Some of the most sophisticated attacks are built to look like business as usual.
Are Businesses Using Microsoft Exchange Also at Risk?
The confirmed incidents involved government organizations, but the findings raise important questions for any company operating its own email infrastructure.
Corporate email servers handle contracts, financial discussions, customer information, internal documents, and sensitive business decisions.
When that infrastructure is compromised, the consequences can extend far beyond a single employee’s inbox.
However, one distinction is essential.
ESET did not claim that every Microsoft Exchange server is vulnerable to Cereal or that the malware is spreading indiscriminately.
The investigation documents targeted intrusions against specific organizations.
The published analysis also does not establish how the attackers initially gained access to the compromised environments.
Therefore, it would be inaccurate to claim that these attacks necessarily began with a particular Exchange vulnerability or a phishing campaign.
For organizations using Exchange, the broader lesson is that security cannot depend exclusively on detecting suspicious files.
Monitoring unusual process behavior, investigating unexpected service changes, keeping systems updated, and protecting administrative access are all important defensive practices.
Security tools capable of identifying malicious activity inside legitimate processes are also valuable, especially when sophisticated attackers deliberately exploit trusted software components.
What Does This Discovery Reveal About the Future of Cyber Espionage?
The Cereal toolkit demonstrates how cyber espionage operations can exploit the infrastructure organizations rely on every day.
Instead of targeting individual computers alone, attackers may focus on central systems that process information for many users.
Email servers are particularly attractive targets. By compromising such an environment, attackers can potentially monitor communications, execute commands, and gather information about the organization’s internal structure.
In the incidents investigated by ESET, the combination of modular malware, in-memory execution, and manipulation of Exchange’s email transport process revealed a carefully engineered operation.
And perhaps that’s the most uncomfortable part of the entire story. Emails can continue arriving. Employees can keep working. Business operations can appear completely normal.
All while someone else is quietly watching. Because in modern cyber espionage, the most sophisticated attack isn’t always the one that brings an organization to its knees. Sometimes, it’s the one that makes sure nobody notices anything is wrong.
