Turla's 'Cereal' malware turns Exchange servers into their own C2

A new espionage toolkit runs entirely on compromised Microsoft Exchange servers — no external command-and-control infrastructure, no suspicious outbound traffic, nothing to block or take down. ESET attributes it to Russia-aligned APT group Turla, and it has already touched government bodies in Kazakhstan and Romania.

That's the headline from ESET's new report, which describes a "sophisticated, modular, and tightly interconnected" toolset the researchers named Cereal — a nod to its heavy reliance on serialization, the technique for packaging data and code for transport. It comprises a novel Exchange email collection module, a stealthy command-and-control mechanism, and .NET execution tricks. It leaves little on disk.

Why does no C2 matter?

Most network defenses watch for traffic heading to a suspicious destination. Cereal gives them nothing to watch.

"ESET found no attacker-controlled server. None," said Frank Dickson of Dickson Research. The victim's own Exchange server becomes the command center, with a passive backdoor waiting for encrypted requests on web paths that mimic ordinary Outlook Web Access, Autodiscover and ActiveSync traffic.

"Cereal never calls home. It is home," Dickson said. "The attackers walk in through the front door, dressed as Outlook."

Operators deliver commands as separate but similarly structured executables, suggesting an automated framework. The toolkit executes commands in memory, maps the victim organization, and collects selected email messages. An automated collection module injects into legitimate Exchange processes, giving attackers access to the email transport pipeline. "This requires deep understanding of the inner workings of Microsoft Exchange and is a novel technique," the ESET researchers wrote.

What does the attack chain look like?

Picture it. An official in a national government office emails a colleague at a transnational military alliance. The message leaves through Exchange exactly as it should. But before departure, code quietly inspects it, decides whether it's interesting, and if so, sets aside a copy for prying eyes. The original continues on its way.

A component dubbed CerealBox selects messages with .doc, .docx and .pdf attachments from chosen senders, recipients and subjects. In Romania, ESET found it collected mail involving NATO and EU addresses.

The technique matters beyond government. Swap in your preferred targets — outside counsel, an acquisition target, a regulator — and the payload becomes a contract, a deal memo or a legal strategy. "It is the postal carrier who steams open the envelope, copies the letter, and reseals it before delivery," Dickson said.

The documented commands go further: pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups and computers. An Exchange server sits deep inside the identity fabric — internet-facing, highly privileged and complex. "Own it, and you hold the keys to the kingdom if you will," Dickson said.

ESET called the transport-pipeline work a level of investment "uncommon even among sophisticated APT actors," concluding that Exchange servers are not just mail servers but durable collection points, internal execution hubs and a suitable environment for hiding .NET tradecraft.

What should enterprises do?

Dickson's advice is blunt:

• Migrate or retire on-premises Exchange where possible.
• Treat whatever remains as a tier-zero asset, "guarded like a domain controller."
• Limit internet exposure of Outlook Web Access and ActiveSync to genuine business need.
• Hunt with ESET's indicators and watch for unexpected code loading into Exchange's transport process.

One gap remains. The report maps what Turla did inside these organizations in "remarkable detail," but never explains how Turla got in. No vulnerability is named, no stolen credential or phishing email described. "A burglar who leaves no fingerprints is impressive," Dickson said. "A burglar whose way in remains unknown is a problem for every house on the street."

David Shipley, CEO of Beauceron Security, noted the gap between nation-state hackers and criminals has collapsed in recent years, particularly thanks to AI — "then you see something like this, which is still a level above." Cloud-hosted Exchange raises the bar but doesn't guarantee safety, he cautioned. And Microsoft's own advice to keep antivirus scanners away from processes like ExchangeTransport.exe, for stability reasons, creates a Catch-22: "They basically told criminals where to hide and why it's good to hide there."

The second Catch-22 is publication itself. With the report now public, "we'll likely see criminal groups consider the value of this kind of technique in the future," Shipley said. Cereal may be Turla's breakfast — but the recipe just went public.