Turla's New Cereal Toolset Reads Government Email From Inside Exchange and Answers Only to Requests That Look Like Exchange. ESET Published the File Names. Here Is What to Hunt
If you run on-premises Microsoft Exchange, especially for a government body, look today for two DLL files in C:\Windows\System32\wbem\ named ncobjapi.dll and wbemcomn.dll, and for a file named Microsoft.Exchange.Search.Mdb.ni.dll in the .NET native image cache that you cannot match to a Microsoft update. ESET Research published a report on November 10, 2026 describing a Turla toolset called Cereal that sits inside the Exchange mail transport process, copies selected messages, and takes commands through web requests that look like normal Exchange traffic. ESET found it at two government bodies. It does not say how the attackers got in.
What has been reported
The primary source is ESET Research, "Exchange for breakfast: Turla's Cereal tricks are not for kids," by Matías Porolli, November 10, 2026. BleepingComputer reported on it the same day and adds nothing beyond ESET. ESET attributes the activity to Turla, the Russia-aligned group, with high confidence, based on another Turla-linked component present at the same time and conceptual similarities to older Turla malware, including the Neuron backdoor family that the UK's NCSC documented in 2017.
- Kazakhstan: a government organization where ESET says it found the toolset on November 28, 2025, with activity surging on January 15, 2026.
- Romania: a government organization compromised on December 23, 2025. There the mail collector targeted messages to or from NATO and EU addresses.
- Initial access: the report does not describe it. ESET says it could not identify the operators' ingress addresses.
How it works
Cereal is a set of .NET components. The names below are ESET's.
- CerealBox collects mail. It injects into EdgeTransport.exe, the Exchange transport process, and wraps the transport agent handlers that are already loaded in memory. ESET: "CerealBox doesn't add a new agent; it hijacks existing ones loaded in memory." That is the point: a defender who lists the registered transport agents sees nothing new. The operators set it to take messages with .DOC, .DOCX or .PDF attachments that match sender, recipient and subject filters. It stages the matches as compressed, encrypted files on disk.
- CerealNeuron is a passive backdoor with no built-in commands. It makes no outbound connections. It listens on port 443 for requests on paths that resemble real Exchange services and runs the .NET assemblies they carry. Requests that fail its integrity check are redirected to a legitimate-looking Exchange error page. The paths ESET lists are /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/.
- CerealRunner carries encrypted .NET programs with their arguments, runs them in memory and returns the output through CerealNeuron. From the news report: operators used it to pull email, query Active Directory, extract stored credentials, and read or delete files.
- CerealHermit is a variant with the network code removed. It reads its commands from encrypted files on disk and writes encrypted results back. ESET did not explain how those files are placed or collected.
- Others ESET names: CerealLoader (the only unencrypted .NET file on disk), CerealSprinter, CerealIron (an injector) and CerealMoth.
Because the Exchange server itself is the only control point and the traffic blends with real Exchange requests, ESET observed no external command server. There is nothing to put on a domain or IP blocklist, and blocking those three paths is unlikely to be practical on a working mail server.
How it stays loaded
ESET describes DLL placement that loads on its own: CerealLoader as ncobjapi.dll or wbemcomn.dll in the WMI folder, loaded by the WMI service, and a malicious file in the .NET native image cache that loads when Exchange asks for the matching library. We read that as persistence; ESET's article does not use the word.
What to do
- Look for ncobjapi.dll and wbemcomn.dll in C:\Windows\System32\wbem\ and compare their hashes and signatures with a clean server of the same build. Look for Microsoft.Exchange.Search.Mdb.ni.dll in the native image cache that does not match a Microsoft-signed copy.
- Check what is loaded into EdgeTransport.exe. A mail transport process that holds an unsigned or unexpected .NET module is the signal; the list of registered transport agents will look normal.
- Review IIS logs for the three paths above, looking for requests from addresses that have no business hitting them, and for unusual POSTs. These paths are legitimate Exchange paths, so expect noise; the signal is the source and the volume.
- Look for large encrypted or compressed files in unexpected folders on the Exchange server.
- Pull ESET's indicator list from its malware-ioc repository on GitHub (the turla folder) and its white paper. As of this morning we checked the repository's turla page and it does not mention Cereal, so the indicators may not have been added yet or may live elsewhere; ESET's report is the place to start.
- If you find any of it, treat the server as compromised along with every credential it could read: Active Directory accounts, service accounts and anything stored on the box. Rebuild Exchange from clean media, and do not assume patching removes a loader that lives in a system folder.
- Patch and harden Exchange as you would anyway. ESET does not name a vulnerability for entry, so this is hygiene, not a fix for this campaign.
What is not known
How the attackers got into the two servers. Whether other organizations were hit, since ESET names two victims and describes a toolset built for long-term use. Whether the hashes and file indicators are published yet. Whether the Kazakhstan and Romania activity is one operation or two, though ESET treats it as one toolset. How ESET's high-confidence attribution compares with other vendors' views; we have seen only ESET's.
How we know, and how we checked
We read ESET's report in full for the components, victims, file names, paths and attribution, and read BleepingComputer's summary. They are one source. We did not examine any sample and did not test any server. We checked our corpus for Turla Cereal and found nothing earlier, so this is new to us. We add no indicators to our feed: ESET's report contains no hashes or hosts in the article text, and the GitHub list did not yet carry Cereal when we looked. When ESET publishes the hashes we will ingest them, cited to ESET.
Sources
ESET Research, "Exchange for breakfast: Turla's Cereal tricks are not for kids," November 10, 2026. BleepingComputer, "Turla hackers use new Cereal malware to spy on govt Exchange servers," November 10, 2026. The Hacker News, "Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers," November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.