#ESETresearch has uncovered Cereal, a previously undocumented modular .NET toolset used by the Russia-aligned #Turla #APTgroup to turn victims’ Microsoft Exchange servers into stealthy long-term collection points. https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/ We identified two national governmental organizations compromised by Cereal: one in 🇰🇿 Kazakhstan and one in 🇷🇴 Romania. Both cases align tightly with Turla’s known targeting priorities. The main backdoor, #CerealNeuron, is a passive implant with no external C&C. It binds an HTTP listener to Exchange-like URI prefixes and passively parses inbound HTTPS requests, extracting RSA/AES-encrypted commands hidden in legitimate-looking Exchange traffic. The email collection module, #CerealBox, is injected into Exchange’s EdgeTransport.exe to hijack the delegates of legitimate transport agents in memory. This avoids the on-disk footprint left by registered agents, a technique not previously documented for any malware family. #CerealLoader, the only on-disk component, exposes a native entry point via .NET VTable Fixups to invoke unmanaged shellcode before any managed code runs. It also abuses the Native Image Cache to plant precompiled malicious images that Exchange loads instead of the originals. Our full technical analysis of Turla's Cereal toolset is available in the white paper: https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf IoCs are included there and also in our GitHub repo: https://github.com/eset/