Turla espionage campaign using Cereal toolkit against Microsoft Exchange

Turla, a Russian state-linked espionage group, has been observed deploying a custom toolkit named Cereal to compromise government email servers in Romania and Kazakhstan. The toolkit is specifically engineered to operate stealthily within Microsoft Exchange environments. It minimizes its detection footprint by avoiding external command-and-control infrastructure, instead repurposing the compromised Exchange server itself as an operational hub. The campaign has successfully targeted email correspondence involving NATO and EU institutions.

Attack Chain

1. Initial access to the target environment (method currently undetermined).
2. Deployment of the Cereal toolkit onto the Microsoft Exchange server.
3. Integration of the CerealBox component into legitimate Exchange services responsible for email traffic processing.
4. Monitoring and interception of specific email traffic of interest.
5. Execution of commands and management of operations directly through the compromised Exchange server processes.
6. Exfiltration of intercepted intelligence.

Impact

The primary impact is long-term, stealthy espionage. Attackers have successfully intercepted messages involving government correspondence, specifically those related to NATO and EU institutions. The full extent of data compromised remains undetermined.

Recommendation

• Audit Microsoft Exchange server processes for unauthorized modules or unrecognized CerealBox component behavior.
• Review Exchange server configurations for anomalous mail flow rules or unauthorized modifications to native services.
• Implement strict monitoring of Exchange server traffic for unusual outbound connections initiated by internal service processes, even if the primary C2 is local to the server.
• Increase logging verbosity for Exchange transport and processing services to capture potential intercept activity.