A global cybersecurity firm, ESET, has uncovered a newly identified malware framework called Cereal, engineered to operate on compromised Microsoft Exchange servers for extended espionage campaigns. The toolkit leverages serialization—used to bundle data and code—featuring a specialized module for harvesting emails, a covert command-and-control system, and advanced .NET-based execution methods. Researchers note its modular design and tight integration.
The malware is being used by nation-state actors to attack government bodies, but enterprises should still be concerned. According to Frank Dickson of Dickson Research, “Tradecraft like this tends not to stay with its inventors.” He notes that criminal groups study nation-state techniques and may eventually adopt them.
Sophisticated Tradecraft
ESET characterizes Cereal as a malicious toolkit operating on Microsoft Exchange servers, executing commands in memory, mapping victim organizations, and harvesting specific emails. It features a passive backdoor on targeted servers, minimizing disk footprint while providing access.
Researchers highlight the toolkit’s unique absence of external command-and-control infrastructure. Instead, the compromised Exchange server itself is repurposed to fulfill this role. Commands are delivered as distinct but similarly structured executables, indicating an automated system.
A module for automated email collection is embedded within legitimate Microsoft Exchange processes, enabling attackers to access and manipulate the email transport pipeline. This technique, requiring deep knowledge of Exchange’s inner workings, is considered novel by researchers.
Attack Chain
In a typical attack, an official from a national government sends an email to a colleague at a transnational military alliance via a Microsoft Exchange server. Before the email is sent, a piece of code inspects it, identifies if it’s of interest, and if so, copies it for forwarding to unauthorized parties.
The original email continues on its way as usual, and the victim’s Exchange server is used as a “durable collection point” and internal execution hub.
The researchers discovered that the malware has so far been used to target Kazakhstan and Romania. ESET attributes the toolkit to Russia-aligned APT group Turla. The attackers made a significant effort to remain undetected, with no external command-and-control channel and a focus on stealth mode.
According to Dickson, the victim’s own Exchange server is the command center, and the backdoor waits for encrypted requests on web paths that look like ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic. This makes it difficult for network defenses to detect the malware, as there is no suspicious traffic leaving the server.
Cereal never calls home, instead using the compromised Exchange server as its base of operations. This is a significant concern, as it allows the attackers to remain hidden and continue to collect sensitive information. The malware’s ability to inject itself into Exchange’s mail process and wrap legitimate transport agents makes it even more difficult to detect.
A component dubbed CerealBox selects messages with .doc, .docx, and .pdf attachments from chosen senders, recipients, and subjects. In Romania, ESET discovered that it collected mail involving The North Atlantic Treaty Organization (NATO) and EU addresses. This should concern enterprises, as it shows the potential for the malware to be used to steal sensitive information.
The commands documented by ESET include pulling entire mailboxes, extracting credentials stored on the server, and querying Active Directory for users, groups, and computers. An Exchange server sits deep inside the identity fabric, making it a prime target for attackers. According to Dickson, “Own it, and you hold the keys to the kingdom if you will.”
