On a compromised Change server, probably the most fascinating exercise will not be all the time the message that arrives in a person’s inbox.
Someplace in a nationwide authorities workplace, an official sends an electronic mail to a colleague at a transnational navy alliance. The message goes out by means of a Microsoft Change server, precisely because it ought to, and nothing appears suspicious. However earlier than the e-mail leaves the constructing, a chunk of code quietly examines it, decides that it’s fascinating, and units apart a replica to be forwarded to prying eyes, whereas the unique electronic mail continues on its method.
On November 28th, 2025, we discovered the toolset that installs such code on an Change server of a governmental group in Kazakhstan. What initially appeared like separate suspicious elements quickly revealed a beforehand undocumented toolset: a set of modular .NET malware designed to run on Microsoft Change servers, obtain instructions, execute them in reminiscence, map the compromised group, and gather chosen electronic mail messages. After fine-tuning our detections, we discovered the identical toolset at a governmental group in Romania – compromised on December 23rd, 2025 – the place it was configured to determine emails despatched to, or acquired from, The North Atlantic Treaty Group (NATO) and European Union (EU).
As a result of the instruments rely closely on serialization (a way for packaging information and code for transport), we have now given them names that begin with the prefix “Cereal”. What makes this toolset stand out is its mixture of novel methods requiring deep information of Change internals with uncommon .NET execution strategies.
One of the vital fascinating features of this toolset is what we did not discover: exterior command and management (C&C) infrastructure. As a substitute – including insult to harm – the sufferer’s compromised Change server is co-opted to behave because the C&C infrastructure.
We attribute Cereal, with excessive confidence, to the Russia-aligned APT group Turla, primarily based on the concurrent use of one other element publicly linked to Turla and conceptual similarities to older Turla malware. The complete technical evaluation is obtainable in our white paper.
Key factors of this blogpost:
- We initially noticed an undocumented toolset at a governmental group in Kazakhstan. After fine-tuning our product’s detection of those instruments, we found a compromised governmental group in Romania a month later.
- We uncovered a complicated, modular, and tightly interconnected toolset, designed to run on Change servers of compromised entities, for long-term cyberespionage.
- No exterior community infrastructure was noticed. One of many malicious elements, a passive backdoor that runs on Change servers, supplies entry to the inner community.
- Instructions are despatched by the operators within the type of separate executables with an analogous, custom-built construction. This hints on the existence of a framework that automates compilation and supply of instructions.
- An automatic electronic mail assortment module, injected into legit Microsoft Change processes, accesses and manipulates the e-mail transport pipeline. This requires deep understanding of the internal workings of Microsoft Change and is a novel approach.
- Using numerous .NET methods, reminiscent of unmanaged entry factors, and abuse of the .NET native picture cache makes this toolset fairly refined compared to most up-to-date APT instances that we have now researched.
Victimology and geopolitical context
Turla, also referred to as Snake, has been lively since a minimum of 2004 and is broadly assessed to be a part of Russia’s Federal Safety Service (FSB). Its standard targets are governments, diplomatic missions, and protection organizations, primarily throughout Europe, Central Asia, and the Center East. We now have documented a big a part of Turla’s arsenal on WeLiveSecurity. In 2025, we additionally reported uncommon cooperation between Turla and Gamaredon in our blogpost Gamaredon X Turla collab and in our white paper Gamaredon in 2025: Leveraging tunnels, employees, lifeless drops, and new alliances.
The Cereal toolkit demonstrates Turla’s skill to hold out a gradual, cautious, long-term intrusion constructed round Microsoft Change servers.
We recognized two nationwide governmental organizations compromised by Cereal, in geographies that align carefully with Turla’s recognized concentrating on. Primarily based on ESET telemetry, round 70% of nations focused by Turla since 2022 have been former Soviet republics or European international locations that had been as soon as carefully aligned with the Soviet Union. The geographic distribution of the 2 confirmed compromises is proven in Determine 1.
The Romanian case is notable as a result of one element, CerealBox, was configured to gather messages involving NATO and EU institutional addresses. This focus suits long-standing Russian intelligence priorities. It could additionally relate to regional tensions: since early 2025, Romania has reported a number of incidents involving Russian drones crashing close to or inside its territory, prompting sturdy reactions from Romanian authorities and requires a NATO mission within the Black Sea area.
The Kazakh compromise additionally occurred in a related political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had beforehand discovered relative security there after Russia’s full-scale invasion of Ukraine. Compromising a Kazakh governmental physique suits a state of affairs by which the operators need visibility into Russian dissidents recognized to Kazakh authorities however not but on any deportation listing.
There may be yet another element price noting. Exercise in Kazakhstan surged on January 15th, 2026 – the day after the Outdated New Yr, an off-the-cuff vacation nonetheless noticed in Russia and a few neighboring international locations. Whereas malware doesn’t have a good time holidays, its operators do.
Tracing the Cereal crumbs
The primary elements we discovered didn’t resemble a traditional backdoor. There was no apparent monolithic implant, no built-in command listing, and no easy beaconing sample. As a substitute, the exercise appeared as a series of specialised elements: encrypted payloads on disk, .NET assemblies embedded inside different .NET assemblies, legit Home windows processes loading suspicious DLLs, and Change companies executing code that didn’t belong there.
Reconstructing that chain revealed a modular toolset constructed round a number of recurring design rules: hold payloads encrypted, hold execution in reminiscence at any time when potential, reuse the compromised Change server, and ship instructions as separate .NET assemblies. Determine 2 exhibits the relationships between all the noticed elements of the toolset.
Primary elements are:
- CerealLoader, which hundreds and runs a .NET meeting from an encrypted file on disk. That is the one element within the toolset that’s written to disk as a recognizable .NET file. All the pieces else is delivered inside encrypted containers, unpacked at runtime, and executed from reminiscence.
- CerealRunner, which incorporates different encrypted binaries which can be loaded and executed. It supplies a strategy to encapsulate and ship instructions, in addition to different elements.
- CerealSprinter, which has similarities to CerealRunner, however is used solely to load and run different elements.
- CerealNeuron, a passive backdoor with no built-in instructions however able to executing assemblies contained in CerealRunner binaries, acquired in community requests; we named it in reference to Neuron, a malware household documented and attributed to Turla by the UK’s Nationwide Cyber Safety Centre in 2017, provided that they’re functionally comparable.
- CerealHermit, a variant of CerealNeuron with no community functionalities. It reads instructions from encrypted information on disk.
- CerealIron, an injector that enables operators to load and run .NET assemblies from non .NET processes.
- CerealBox, which processes, filters, and collects fascinating electronic mail messages by being injected into Microsoft Change’s transport service.
- CerealMoth, a easy element that receives an meeting and a technique title as arguments, hundreds the meeting, and runs the desired methodology.
When the sufferer’s Change is the infrastructure
Probably the most notable facet of this marketing campaign is what we didn’t discover: an attacker-controlled server.
Most backdoors periodically contact their operators. That conduct leaves traces – domains, IP addresses, internet hosting suppliers, timing patterns – that defenders determine and block. CerealNeuron, the principle backdoor within the Cereal toolset, does none of that. As a substitute of initiating outbound connections, it waits for incoming requests.
CerealNeuron runs on the compromised Change server and passively listens for incoming net requests on paths that appear like atypical Change site visitors. Among the many paths we noticed:
- https://*:443/owa/sdds/
- HTTPS://*:443/AUTODISCOVER/PROXYSERVICE/
- HTTPS://*:443/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/
To a firewall log or an analyst reviewing site visitors, requests to those paths mix in with legit Outlook Internet Entry, Autodiscover, and ActiveSync site visitors. If a request for a useful resource on one among these paths is correctly encrypted and passes a number of integrity checks, CerealNeuron decrypts it, treats the contents as a command, and runs it. If a request appears flawed, CerealNeuron redirects the consumer to a legitimate-looking Change error web page.
The implications are important:
- There is no such thing as a devoted C&C infrastructure to find, block, or take down. The sufferer’s personal internet-facing Change server is the operator-accessible management level.
- Community-based monitoring is severely restricted. We had been unable to determine the ingress IP addresses utilized by the operators. They might have related immediately, by way of anonymization companies, or from different compromised hosts.
- Malicious site visitors coexists with legit Change net companies – precisely the form of site visitors defenders are least prone to block.
Determine 3 exhibits the communication stream between operators and CerealNeuron.
Abusing a compromised Change server as a central operational hub is a uncommon approach, utilized by solely a handful of APT teams. Turla has used variations of this method up to now. With Cereal, counting on the sufferer’s Change server removes the necessity for devoted attacker infrastructure.
The toolset additionally supplies a fallback mechanism. CerealHermit is a variant of CerealNeuron with the community components eliminated. As a substitute of ready for net requests, it reads encrypted command information from disk and writes encrypted outcomes again. In some intrusions, each backdoors had been deployed collectively, giving operators two impartial methods to achieve their objectives.
Instructions as disposable applications
Relatively than a single giant backdoor containing each potential command, Turla’s operators ship every command as its personal small, compiled .NET program.
The core execution element is CerealRunner. It carries different encrypted .NET applications inside itself, together with the arguments wanted to run them. When it executes, it unpacks its payloads, runs them in reminiscence, and returns their output by means of the identical pipeline so CerealNeuron can encrypt and ship it again.
We detected quite a few CerealRunner binaries throughout the 2 intrusions. They share the identical construction however differ within the small piece of code that implements every particular process.
The instructions embrace:
The sheer quantity of near-identical binaries, every compiled for a particular process, strongly means that the operators have an inside framework that automates the compilation and packaging of instructions. Mixed with a codebase constructed round modular, interchangeable elements, the impression is one among a mature, well-engineered platform – fairly than a free assortment of scripts.
.NET methods that aren’t for youths
What distinguishes Cereal from most up-to-date APT instances is how deeply it leverages the internal workings of .NET, Microsoft’s software program framework that powers a big a part of Home windows and Change itself.
Usually, .NET applications run by means of the Widespread Language Runtime (CLR), which converts a program’s directions into machine code simply earlier than working them. This entire course of is seen to straightforward evaluation instruments. Cereal repeatedly operates exterior these customary, observable paths.
A .NET program that runs native code earlier than any .NET code
CerealLoader is the one Cereal element written to disk in unencrypted type. In a .NET decompiler, the entry level code does basically nothing, and a breakpoint set on the malicious methodology isn’t triggered.
In observe, CerealLoader executes low-level, machine-native code earlier than the .NET runtime even begins working its regular directions. It abuses a hardly ever used characteristic of the .NET specification, Vtable Fixups, to construct a hidden bridge from native code again right into a .NET methodology that no different a part of this system seems to name. An analyst inspecting solely the .NET aspect sees code that seems to do nothing. By that time, the true payload has already run.
Hijacking legit Home windows elements
As a result of CerealLoader can bootstrap itself from native code, the operators can drop it in locations the place legit, non-.NET Home windows processes will load it. In a single execution chain, CerealLoader was positioned as ncobjapi.dll inside C:WindowsSystem32wbem, the place the Home windows Administration Instrumentation service loaded it routinely. In one other, it impersonated wbemcomn.dll in the identical folder. The malicious DLL forwards legit operate calls, so the affected course of continues to function usually.
Abuse of the .NET native picture cache
To enhance startup efficiency, .NET retains a cache of precompiled variations of frequent libraries in a system folder. When a program asks for one among these libraries, the runtime checks the cache first and, if there’s a match, hundreds the cached model as a substitute of JIT-compiling the meeting’s code. The operators positioned malicious CerealLoader information on this cache, utilizing names reminiscent of Microsoft.Change.Search.Mdb.ni.dll. When Change requested for the corresponding library, the runtime loaded the malicious model as a substitute. As a result of the malicious file incorporates no actual alternative code, .NET quietly falls again to the real library for precise performance – however not earlier than the attackers’ native entry level code has executed. In a single pattern, the malicious code solely prompts when the father or mother course of is Change’s search service.
Every of those methods is documented in lesser-known components of the .NET specification. What’s uncommon is seeing them mixed so intentionally in a single toolset, and used particularly to cover inside Microsoft Change.
CerealBox: hooking Change from the within
The Cereal element that makes use of probably the most novel approach is CerealBox, an electronic mail assortment module constructed for Microsoft Change.
Turla has focused Change servers earlier than, together with by means of the abuse of transport brokers – a legit Change characteristic that lets builders hook into the stream of electronic mail for duties reminiscent of spam filtering. Put in transport brokers, nonetheless, go away seen traces in Change’s configuration.
CerealBox makes use of a stealthier method. As a substitute of registering itself, it’s injected immediately into EdgeTransport.exe, the Change course of that handles electronic mail stream. Reaching that time, nonetheless, will not be easy: CerealBox is delivered by means of an intricate chain of nested Cereal elements, illustrated in Determine 4.
As soon as inside, CerealBox accesses Change’s inside buildings, finds the prevailing transport brokers, and wraps their handlers with malicious code. The wrappers run CerealBox’s personal logic first, then hand management again to the unique code. E mail continues to stream usually. No new agent seems anyplace in Change’s configuration. Briefly: CerealBox doesn’t add a brand new agent; it hijacks current ones loaded in reminiscence.
Having visibility into the mail stream, CerealBox picks out messages of curiosity. A message qualifies if it has a .doc, .docx, or .pdf attachment and matches a minimum of one among a number of hardcoded lists – sender addresses, recipient addresses, topic substrings, or attachment names – whereas avoiding matching ignore lists. Fascinating messages are compressed, encrypted, and staged in information on disk. Operators later use atypical CerealNeuron instructions to exfiltrate and delete these information.
Injecting into the Change transport service and hooking mail stream from inside is a novel approach, not beforehand documented for any malware household. It requires a deep understanding of how Change’s mail pipeline is structured internally – the form of information that requires important effort and time to accumulate.
Conclusion
The Cereal toolset is a rigorously constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids exterior infrastructure that could possibly be found and blocked, and conceals itself inside legit Change processes. Using unmanaged entry factors, VTable Fixups, native picture cache abuse, and in-memory injection into Change’s transport pipeline displays a stage of funding in .NET tradecraft that’s unusual even amongst refined APT actors.
The Cereal toolset demonstrates that, for Turla, Change servers should not simply mail servers – they’re sturdy assortment factors, inside execution hubs, and an appropriate surroundings for hiding refined .NET tradecraft.
For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.ESET Analysis presents personal APT intelligence reviews and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.
IoCs
A complete listing of indicators of compromise (IoCs) might be present in our GitHub repository and the Turla white paper.
