Russia-aligned hacking group Turla, also known as Snake, is using a new, undocumented toolset called Cereal to break into Microsoft Exchange servers and quietly collect emails. Slovakian security firm ESET shared the findings with The Hacker News on November 10. ESET saw the attacks hit two government bodies, one in Kazakhstan and one in Romania, in late 2025.
The initial way in is unknown, though Turla is known for spear-phishing, watering hole attacks, and ISP-level adversary-in-the-middle attacks. The name comes from the toolset's heavy use of serialization.
ESET called the toolset "A carefully constructed instrument for long-term, stealthy cyber espionage." It leaves little on disk and runs inside legitimate Exchange processes. It does not use an outside command server.
Instead, it turns the hacked Exchange server into the control point. Commands arrive as separate compiled .NET programs that run in memory. An email collection module injects itself into Exchange and works with the email transport pipeline. ESET says this shows Turla has a deep understanding of how Exchange works. The framework has eight parts, including CerealBox, which filters and collects emails.
Also Read: How GuardBreaker Malware Attempts to Outsmart AI Security Analysis
The malware looks for emails with DOC, DOCX, or PDF attachments. It then checks them against hard-coded lists of sender addresses, recipients, subject lines, or attachment names. Matching emails are compressed, encrypted, and stored on disk before they are sent out and deleted.
In the Romanian case, the tool was set to gather emails involving NATO and European Union addresses. ESET says this fits Russia's strategic priorities. The commands can also pull mailboxes, query Active Directory, run WMI queries, and extract LSA secrets.
ESET researcher Matías Porolli said the many near-identical programs point to an internal system that automates their creation. In his view, the platform looks mature and well engineered. Since the initial attack method is unknown, security teams may want to watch Exchange servers closely.