The Mail Server Was Listening. So Was Russia.

Your mail server was never supposed to be the spy. But according to new research from ESET, a Russian state-backed hacking group turned Microsoft Exchange servers at government organizations into listening posts — reading selected emails as they passed through, leaving almost no trace.

The group is Turla — also known as Snake, Secret Blizzard, and Waterbug — a cyber-espionage outfit active for more than two decades and linked to Russia’s FSB. Its new toolset is called Cereal, and ESET documented it in attacks in late 2025: first at a government body in Kazakhstan, then a month later at a government agency in Romania, where the attackers selectively gathered emails with NATO and EU representatives.

How Cereal hides inside Exchange

The heart of the toolset is a component called CerealBox. It injects itself into Exchange’s EdgeTransport.exe process and hijacks the handlers of transport agents that already exist on the server. Transport agents are the small programs Exchange uses to process mail as it flows through — scanning it, routing it, applying rules. Riding inside them, Cereal inspects email content and runs commands in memory — no new transport agent, no interrupted delivery. Nothing new appears in the list of agents. Mail keeps flowing. The server looks healthy. The only difference is that someone else is reading along.

Turla configured the malware to be selective. It collects messages containing document attachments — .DOC, .DOCX, and .PDF files — and only when they match certain sender, recipient, and subject criteria. The attackers knew what they were looking for before they arrived, and they took only that. Selective collection is a hallmark of a mature espionage operation: grab everything and you drown in noise and trip alarms; grab exactly what you need and you can stay for years.

The command channel with no control server

The second component, CerealNeuron, waits for incoming encrypted web requests on paths designed to look like legitimate Exchange services. It decrypts each request, then runs CerealRunner — a wrapper carrying the code the attackers want to execute: retrieve emails, query Active Directory, extract stored credentials, read files, or delete them.

CerealRunner’s payloads are encrypted .NET programs that execute in memory and return their output to CerealNeuron, which encrypts it and sends it back.

ESET noticed the sheer volume of near-identical binaries, each compiled for a specific task, which “strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands.” Combined with a codebase built around modular, interchangeable components, “the impression is one of a mature, well-engineered platform — rather than a loose collection of scripts.”

There is also a variant called CerealHermit, which has no network capability at all. Instead, it reads commands from encrypted files on disk — a fallback in case the web channel goes down. ESET did not explain how the attackers place those command files on the server or retrieve the results.

Most striking of all: ESET observed no external command-and-control infrastructure. The compromised Exchange server itself is the only control point — no separate server to block, no suspicious domain to sinkhole. The mail server is the infrastructure.

Why this one matters

Government email carries negotiations, policy drafts, internal assessments — the attachments that hold the real substance of a discussion.

Cereal abuses the .NET native image cache to run inside legitimate processes, keeps a small disk footprint, and relies on infrastructure that is less likely to be detected and blocked. ESET calls it a toolset designed for “long-term, stealthy cyberespionage.” This is not a smash-and-grab. It is a wiretap built to last.

A backdoor that lives inside a legitimate mail process, using the server’s own machinery, is harder to catch than a backdoored server that leaves no logs — and when four flaws open a single door into a storage device, the fix is at least a patch. Here the fix starts with knowing where to look.

What to do now

Four checks for anyone running Exchange, especially in government or any organization that handles sensitive correspondence:

• Inspect your transport agents. List every transport agent on each Exchange server and verify each one is known and expected. Cereal’s trick is hiding inside existing handlers — an agent you do not recognize, or a handler that behaves differently than documented, is the first place to look.
• Review Exchange and process logs around EdgeTransport.exe. Look for unusual transport-pipeline activity, unexpected .NET assemblies loading into the process, or web requests hitting Exchange-like paths that belong to no installed feature.
• Rotate credentials and review Active Directory queries. CerealRunner can pull credentials and query AD for users, groups, and DNS records. If a server was exposed, assume credentials on it are too — rotate service accounts and look for unusual directory lookups.
• Check ESET’s indicators of compromise. The company shared an extended list of indicators on its GitHub page. Run them against your Exchange servers and endpoint tools — a toolset built for long-term access may have been present longer than the compromise date suggests.

Turla has been at this for more than twenty years, and Cereal shows the group is still refining its craft. The mail server was listening all along. The question is whether anyone else was listening for the listeners.