Ethical Hacking News
The Russian Turla hackers have been using a sophisticated new malware called "Cereal" to steal emails from government exchange servers. The malware is designed to be stealthy and long-term, and is capable of running on Microsoft Exchange servers. The hackers are known to use spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks to deliver the malware. The Cereal toolset consists of eight moving parts that work together to provide the attackers with access to sensitive email data. This is a significant development in the world of cybersecurity, and highlights the ongoing threat posed by state-sponsored hackers.
The "Cereal" malware is a sophisticated strain of malware used by the Russia-aligned state-sponsored threat actor Turla to break into Microsoft Exchange servers and collect emails. The malware is designed to be stealthy and long-term, using techniques such as serialization and abusing compromised Exchange servers for command-and-control. The malware consists of eight moving parts that work together to provide attackers with access to sensitive email data. The threat actor uses spear-phishing, watering hole, and ISP-level adversary-in-the-middle attacks to deliver the malware. The malware has various components, including CerealRunner, CerealLoader, CerealSprinter, and CerealMoth, which work together to provide the attackers with access to sensitive email data. The malware has a modular, interchangeable design, suggesting a mature and well-engineered platform.
The world of cybersecurity is constantly evolving, with new threats and techniques emerging on a daily basis. Recently, a new strain of malware has been discovered, which has left security experts and researchers stunned. Dubbed "Cereal," this sophisticated malware is being used by the Russia-aligned state-sponsored threat actor known as Turla, also referred to as Snake. The malware is designed to break into Microsoft Exchange servers with the aim of surreptitiously collecting emails.
According to an ESET report shared with The Hacker News, the Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes. The Cereal toolset is a collection of interconnected components that are capable of running on Microsoft Exchange servers, receiving commands, executing them in memory, mapping the infected network, and harvesting emails of interest.
The initial access vector used to deliver the malware is unknown, although the group is known to conduct spear-phishing, watering hole, and ISP-level adversary-in-the-middle (AitM) attacks. Cereal gets its name from the fact that the tools make extensive use of serialization, which refers to the process of converting a data structure or an object's state into a format that can be easily stored, transmitted, and reconstructed.
A number of aspects make the malware stand apart, including the absence of an external command-and-control (C2) infrastructure, instead abusing a compromised Exchange server for this purpose. Sending commands in the form of separate, compiled .NET programs. Using an automated email collection module, which is injected into legitimate Microsoft Exchange processes and is engineered to manipulate the email transport pipeline.
The combination of these techniques shows that the threat actor possesses a deep understanding of the internal workings of Microsoft Exchange, ESET added. The Cereal framework consists of eight moving parts that work together to provide the attackers with access to sensitive email data. CerealRunner, which is deployed by the operator and serves as a pathway for dropping additional components, including CerealLoader, CerealSprinter, CerealIron, and CerealMoth.
CerealLoader, which loads and runs a .NET assembly from an encrypted file on disk, leading to the execution of CerealSprinter. CerealSprinter, which functions similarly to CerealRunner and is used to decrypt and run CerealNeuron, CerealHermit, and CerealBox. CerealIron, an injector that makes it possible to load and run .NET assemblies from non .NET processes. CerealMoth, which receives an assembly and a method name as inputs, loads the assembly, and runs the specified method.
CerealNeuron, a passive backdoor that runs on a compromised Exchange Server and listens for incoming web requests on paths that appear like regular Exchange traffic to execute assemblies contained in CerealRunner binaries. CerealHermit, a variant of CerealNeuron that reads commands from encrypted files on disk and has no network functionality of its own. CerealBox, which is the email harvesting module that processes, filters, and collects email messages by injecting itself into the Exchange transport service ("EdgeTransport.exe").
Upon gaining visibility into the email flow, the malware looks for messages containing DOC, DOCX, or PDF attachments, and matches at least one of many hard-coded lists with sender addresses, recipient addresses, subject lines, or attachment names. Emails that meet the filtering criteria are compressed, encrypted, and staged in files on disk, after which they are exfiltrated and deleted via CerealNeuron commands. In the attack aimed at the Romanian government organization, CerealBox is said to have been configured to gather emails involving NATO and European Union institutional addresses, a pattern that aligns with Russia's strategic priorities.
The commands delivered as compiled .NET programs are handled by CerealRunner, which unpacks and executes the payloads in memory and then sends the results back to CerealNeuron for subsequent exfiltration to the threat actor in encrypted format. The commands support retrieving mailboxes or specific messages; queuing Active Directory for computers, users, groups, and DNS records; running Windows Management Instrumentation (WMI) queries; extracting LSA Secrets; listing volume snapshots; and performing file operations.
The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands. Combined with a codebase built around modular, interchangeable components, the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Sophisticated-Cereal-Malware-A-New-Avenues-of-Attack-for-Russian-Turla-Hackers-ehn.shtml
https://thehackernews.com/2026/11/russian-turla-hackers-use-new-cereal.html
Published: Tue Nov 10 08:36:02 2026 by llama3.2 3B Q4_K_M
