ESET found a new Russian spy tool called Cereal that hides inside Microsoft Exchange email servers and quietly copies emails from government targets.
A Russian-aligned spy group known as Turla has built a new tool that lives inside Microsoft Exchange email servers and quietly copies emails. Security firm ESET named it Cereal. It was seen in late 2025 against two government bodies, one in Kazakhstan and one in Romania.
Turla, also called Snake, is a state-sponsored hacking group. Cereal had not been documented before. ESET describes it as a modular toolset built for long-term spying. Modular means it is made of separate parts that work together. This one has eight.
ESET says it leaves little on disk, avoids outside servers that defenders could find and block, and hides inside normal Exchange processes. Exchange is a common business email system.
Once running, Cereal watches the mail flowing through the server. It looks for messages with DOC, DOCX or PDF attachments. It then checks them against built-in lists of sender addresses, recipient addresses, subject lines and attachment names.
Matching emails are compressed, encrypted and stored in files on the server. They are then sent out and deleted. The attackers can also send commands that run in the server's memory. Those commands can pull whole mailboxes or single messages, map the internal network and list its computers, users and groups. They can also extract LSA Secrets, a type of stored Windows security data.
The confirmed targets are the two government organizations. In the Romanian case, the tool was set to collect emails involving NATO and European Union institutional addresses. ESET says that fits Russia's strategic priorities.
ESET researcher Matías Porolli said the tool gives the impression of a mature, well-engineered platform rather than a loose collection of scripts. ESET adds that for Turla, Exchange servers are lasting collection points, not just mail servers.
ESET does not know how the attackers first got in. Turla is known for phishing emails, booby-trapped websites and attacks at the internet provider level, but none is confirmed here. The material also does not say how many other organizations were hit.
Businesses that run their own Exchange server should treat it as a target. Keep it updated and watch it for odd activity. Cloud-hosted email is not covered in this report.
If your business runs its own Exchange email server, keep it patched and monitored, because spies treat it as a long-term hiding place.
CISA's new incident form asks for more detail on hacks, and a coming rule could force some firms in 16 key sectors to report attacks within 72 hours.
Read more: US cyber agency asks for more detail when companies report hacksGoogle DeepMind used AI agents to mathematically prove that the core code behind Signal's private messaging does what its designers intended, in four weeks.
Read more: AI checks Signal's encryption code with mathematical proofUS officials say attackers are using a flaw in Cisco BroadWorks, software behind many business phone services, and a patch has been out since August.
Read more: Hackers are exploiting a flaw in Cisco's business phone software
