Overview
- ESET publicly documented the Cereal toolset on November 10, 2026 and said it is a modular .NET framework that runs most payloads in memory and leaves minimal disk artifacts.
- The firm first found Cereal on a Kazakh government Exchange server on Nov. 28, 2025 and after refining detections identified a Romanian government compromise dated Dec. 23, 2025.
- Cereal injects into Exchange's transport process (EdgeTransport.exe) with a module called CerealBox that copies messages with .doc, .docx or .pdf attachments and filters by sender, recipient or subject.
- The framework uses a passive backdoor called CerealNeuron that accepts encrypted web requests that look like normal Exchange traffic so the compromised server itself acts as the attackers’ control point.
- ESET attributes Cereal with high confidence to Turla, a Russia‑linked espionage actor, and published detailed technical analysis and IoCs on GitHub to help defenders hunt for the infections and harden Exchange servers.