What Happened
ESET documented a new modular .NET toolset from Turla, the Russian state group linked to the FSB, BleepingComputer reports. The malware lives inside Microsoft Exchange servers. One component, CerealBox, injects into the EdgeTransport process and hijacks existing transport handlers. It collects emails with Word or PDF attachments matching chosen senders, recipients, or subjects. Mail delivery continues as normal.
Another component, CerealNeuron, waits for encrypted web requests on paths resembling real Exchange services and runs the commands inside them. Those commands pull email, query Active Directory and DNS, and extract stored credentials. ESET found the toolset at a Kazakh government body and a Romanian agency. In Romania, it gathered emails exchanged with NATO and EU representatives. ESET saw no outside command server. The Exchange server itself is the control point.
Why This Matters for Canadian Organizations
Canada is a NATO member and trades sensitive correspondence with allies every day. Federal departments, provincial ministries, and defence contractors still run on-premises or hybrid Exchange. A NATO ally’s government mail server sat compromised for months. Canadian systems hold the same kind of traffic Turla wants.
The design defeats common detection. No new transport agent appears. No outbound beacon shows up in network logs. The malware hides in the .NET native image cache inside legitimate processes. A team watching only for suspicious connections will miss it. The Canadian Centre for Cyber Security has warned about Russian state espionage against Canadian government networks for years.
What to Do
Pull ESET’s indicators from its GitHub repository and hunt across every Exchange server. Check the .NET native image cache for unexpected assemblies. Review IIS logs for encrypted requests to unusual paths under Exchange virtual directories. Move sensitive government correspondence off on-premises Exchange where possible. Report findings to the Cyber Centre. Follow our Trends coverage and latest news.
