---
title: Hunt: Turla's "Cereal" toolset hides in Exchange, taking commands on OWA/Autodiscover/ActiveSync-like URL paths and hijacking transport agents in memory | ctxsec
url: https://ctxsec.com/items/hunt-eset-turla-cereal-exchange-edgetransport-native-image-cache
description: "ESET found a previously undocumented .NET toolset on Exchange servers of a Kazakh government body (found Nov 28, 2025) and a Romanian one (compromised Dec 23, 2025), where it was set to collect mail to or from NATO and EU addresses. There is no external C2: the CerealNeuron backdoor listens on the victim's own Exchange web paths, and CerealBox is injected into EdgeTransport.exe to wrap existing transport-agent handlers, so no new agent shows up in Exchange config."
status: "research (ESET, Matías Porolli, WeLiveSecurity, Nov 10, 2026); attribution to Turla is ESET's, at high confidence"
published: 2026-11-10
---

> ESET found a previously undocumented .NET toolset on Exchange servers of a Kazakh government body (found Nov 28, 2025) and a Romanian one (compromised Dec 23, 2025), where it was set to collect mail to or from NATO and EU addresses. There is no external C2: the CerealNeuron backdoor listens on the victim's own Exchange web paths, and CerealBox is injected into EdgeTransport.exe to wrap existing transport-agent handlers, so no new agent shows up in Exchange config.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-eset-turla-cereal-exchange-edgetransport-native-image-cache.md)

research (ESET, Matías Porolli, WeLiveSecurity, Nov 10, 2026); attribution to Turla is ESET's, at high confidence

2026-11-10

### Hunt: Turla's "Cereal" toolset hides in Exchange, taking commands on OWA/Autodiscover/ActiveSync-like URL paths and hijacking transport agents in memory

- **Listener paths ESET observed:** `/owa/sdds/`, `/AUTODISCOVER/PROXYSERVICE/`, `/MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/` on 443. Check HTTP.sys URL reservations and IIS/HTTPERR logs for these prefixes; bad requests get redirected to an Exchange-like error page.
- **DLL hijack spots:** CerealLoader dropped as `ncobjapi.dll` or `wbemcomn.dll` in `C:\Windows\System32\wbem\`, loaded by WMI. Compare against known-good hashes.
- **Native image cache:** malicious files named like `Microsoft.Exchange.Search.Mdb.ni.dll` planted in the .NET native image cache; one sample activates only under Exchange's search service. Look for NI images whose hashes don't match ngen output on a clean server.
- **Collection:** CerealBox stages messages with .doc/.docx/.pdf attachments that match hardcoded sender, recipient, subject or filename lists into encrypted files on disk; commands also pulled mailboxes via EWS, queried AD, ran WMI and read LSA secrets.
- ESET says IoCs are in its white paper and GitHub repository.

Sources: [ESET WeLiveSecurity: Exchange for breakfast: Turla's Cereal tricks are not for kids (Nov 10, 2026)](https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/) · [ESET Research on X (thread, Nov 10, 2026)](https://x.com/ESETresearch/status/2120094134559965410)