Security researchers have discovered a malware toolkit that does not need an external server to operate. Instead, it moves into the victim’s own Microsoft Exchange server and runs from there. The toolkit, named “Cereal,” intercepts emails in transit, executes commands entirely in memory, and receives instructions through traffic that looks identical to normal Outlook Web Access. No external command and control infrastructure exists. The compromised Exchange server is both the target and the attacker’s base of operations.
Most network defenses watch for traffic leaving toward suspicious destinations. Cereal bypasses that entirely because there is no destination to block and no server to take down.
Global security firm ESET published the findings on November 10 in a detailed report. The researchers attributed Cereal to Turla, a Russia-aligned advanced persistent threat group known for targeting government institutions. So far, confirmed victims include government organizations in Kazakhstan and Romania. In Romania, ESET found that the malware specifically collected emails involving NATO and EU addresses.
The toolkit works by injecting itself into Exchange’s legitimate transport pipeline. Exchange uses transport agents to inspect emails as they flow through the system. Cereal wraps itself around agents already running in memory. It then silently examines every outgoing email, decides whether it contains something valuable, copies it for extraction, and lets the original continue to its destination. The sender and recipient never know anything happened.
A component called CerealBox handles the targeting logic. It selects messages with .doc, .docx, and .pdf attachments from specific senders, recipients, and subject lines. Meanwhile, additional commands let attackers pull entire mailboxes, extract credentials stored on the server, and query Active Directory for users, groups, and machines across the network.
ESET described the technique as “novel” and noted that it requires deep understanding of Exchange’s internal architecture. The researchers called it a level of investment in email pipeline manipulation that is uncommon even among sophisticated state-backed groups.
What makes Cereal especially dangerous for organizations beyond government targets is its potential to spread. Security experts warn that criminal groups routinely study nation-state techniques and adapt them for financial crime. One analyst compared it to minor league baseball players studying a major leaguer’s grip. What works at the highest level eventually appears everywhere.
Microsoft’s own security guidance compounds the problem. The company advises administrators not to run antivirus scanners on certain Exchange processes, including ExchangeTransport.exe, because doing so can cause instability. That guidance effectively creates a blind spot that attackers now exploit. One expert noted that Microsoft essentially showed attackers where to hide and why it works.
For organizations still running on-premises Exchange, security researchers recommend treating the server as a tier-zero asset with the same protections as a domain controller. They also advise migrating to cloud-hosted Exchange where possible, limiting internet exposure of Outlook Web Access and ActiveSync, and hunting for the indicators of compromise that ESET published alongside its report.
However, the report leaves one critical question unanswered. ESET documented what Cereal does once inside an organization in remarkable detail. It does not explain how Turla gained initial access. No vulnerability, stolen credential, or phishing email is described. That gap means every organization running Exchange faces a threat it cannot fully defend against until the entry point is identified.
