Turla (Secret Blizzard) Cereal modular .NET toolset targets government Microsoft Exchange servers

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5635 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Turla CerealLoader WMI DLL Hijack — ncobjapi.dll / wbemcomn.dll in System32\wbem — Exploitation Phase

Detects the CerealLoader (Turla/Secret Blizzard Cereal toolset) persistence mechanism on Exchange servers. ncobjapi.dll is written to or loaded from C:\Windows\System32\wbem\ (the genuine ncobjapi.dll lives in System32, so the WMI service search order picks up the planted copy), and wbemcomn.dll in the same folder is replaced or loaded unsigned (CerealLoader impersonates it and forwards legitimate calls). Reported by ESET on Kazakh and Romanian government Exchange servers.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1574.002, T1047
• Data sources: sysmon:EventCode=11 (FileCreate), sysmon:EventCode=7 (ImageLoad), DeviceFileEvents, DeviceImageLoadEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=11 OR EventCode=7)
| search (EventCode=11 AND (TargetFilename="*\\System32\\wbem\\ncobjapi.dll" OR TargetFilename="*\\System32\\wbem\\wbemcomn.dll") AND NOT (Image="*\\TrustedInstaller.exe" OR Image="*\\TiWorker.exe")) OR (EventCode=7 AND (ImageLoaded="*\\System32\\wbem\\ncobjapi.dll" OR (ImageLoaded="*\\System32\\wbem\\wbemcomn.dll" AND Signed!="true")))
```ncobjapi.dll is not normally present in the wbem folder; wbemcomn.dll must be Microsoft signed```
| eval stage=case(EventCode=11,"dll_written","dll_loaded")
| eval artifact=coalesce(TargetFilename, ImageLoaded)
| stats earliest(_time) as first_seen latest(_time) as last_seen values(stage) as stages values(Image) as actor_process values(Signature) as signer count as events by host, artifact
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let FileWrites = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where FolderPath contains @"\System32\wbem\"
    | where FileName in~ ("ncobjapi.dll", "wbemcomn.dll")
    | where InitiatingProcessFileName !in~ ("TrustedInstaller.exe", "TiWorker.exe")
    | project Timestamp, DeviceName, Stage = "dll_written", FileName, FolderPath, SHA256, ActorProcess = InitiatingProcessFileName, ActorCommandLine = InitiatingProcessCommandLine;
let DllLoads = DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FolderPath contains @"\System32\wbem\"
    | where FileName =~ "ncobjapi.dll"
    | project Timestamp, DeviceName, Stage = "dll_loaded", FileName, FolderPath, SHA256, ActorProcess = InitiatingProcessFileName, ActorCommandLine = InitiatingProcessCommandLine;
union FileWrites, DllLoads
| sort by Timestamp desc

Sigma

title: Turla CerealLoader WMI DLL Hijack — ncobjapi.dll / wbemcomn.dll in System32\wbem — Exploitation Phase
id: 7c1e5a42-3b9d-4f0e-9a61-2d8f4c5b7e01
status: experimental
description: Detects the CerealLoader (Turla Cereal toolset) persistence mechanism on Exchange servers. ncobjapi.dll or wbemcomn.dll written into C:\Windows\System32\wbem\ by anything other than the Windows servicing stack.
references:
    - https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/
    - https://attack.mitre.org/groups/G0010/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1574.002
    - attack.execution
    - attack.t1047
    - attack.g0010
logsource:
    category: file_event
    product: windows
detection:
    selection_ncobjapi:
        TargetFilename|endswith: '\System32\wbem\ncobjapi.dll'
    selection_wbemcomn:
        TargetFilename|endswith: '\System32\wbem\wbemcomn.dll'
    filter_servicing:
        Image|endswith:
            - '\TrustedInstaller.exe'
            - '\TiWorker.exe'
    condition: (selection_ncobjapi or selection_wbemcomn) and not filter_servicing
falsepositives:
    - Windows servicing or cumulative updates replacing wbemcomn.dll via a servicing process other than TrustedInstaller
    - Third-party WMI repair or system-restore tools rewriting WMI repository files
level: high

Known false positives:

• Windows servicing or cumulative updates replacing wbemcomn.dll through a servicing process other than TrustedInstaller
• Third-party WMI repair or system-restore tools rewriting files in System32\wbem

Tuning notes: Any ncobjapi.dll inside System32\wbem is high fidelity; the wbemcomn.dll branch relies on the Sysmon Signed field, so make sure Sysmon ImageLoad (EID 7) logging covers the wbem folder. Add your patching tool's Image to the exclusion list. Scope to Exchange servers via a host lookup to reduce noise.

• 🔒 Turla Cereal Malicious .NET Native Image Cache Library (Microsoft.Exchange.*.ni.dll) — Exploitation Phase · unlock with TL Creds
• 🔒 Turla Cereal .NET CLR Loaded in Non-.NET WMI and System Processes — Post-Exploitation · unlock with TL Creds
• 🔒 Turla CerealBox Staged Encrypted Mail Archives Written by EdgeTransport.exe — Collection / Exfiltration Staging · unlock with TL Creds
• 🔒 Exchange Transport Process Spawning Shells or Recon Tools (Turla Cereal Tradecraft) — Post-Exploitation · unlock with TL Creds
• 🔒 Unsigned DLL Loaded from System32\wbem by WMI Service Hosts (CerealLoader Hijack Variant) — Persistence · unlock with TL Creds
• 🔒 Exchange Transport Agent Install or Enable via PowerShell — Persistence Baseline Control · unlock with TL Creds
• 🔒 Turla CerealIron / CerealBox Injection into EdgeTransport.exe — Post-Exploitation · unlock with TL Creds
• 🔒 Turla CerealNeuron Passive HTTPS Listener Paths on Exchange IIS — C2 / Command Channel · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5635.

Technical analysis

ESET Research (published 2026-11-10) documents a previously undisclosed Turla toolset, dubbed Cereal, built from modular .NET components and deployed on Microsoft Exchange servers. ESET found it on a Kazakh government Exchange server on 2025-11-28 and on a Romanian government organization compromised on 2025-12-23. ESET attributes the activity to Turla, assessed as part of Russia's FSB, with high confidence, based on concurrent use of another Turla-linked component and conceptual similarities to older Turla malware (such as the Neuron family documented by NCSC in 2017).

The components are: CerealLoader (loads and runs a .NET assembly from an encrypted disk file; the only component written to disk unencrypted; uses Vtable Fixups so that native code runs before the .NET runtime and decompilers show an empty entry point), CerealRunner and CerealSprinter (carry encrypted binaries and arguments, unpack and run them in memory), CerealNeuron (passive backdoor with no built-in commands that listens for HTTPS requests and executes received CerealRunner assemblies), CerealHermit (CerealNeuron variant without network functions that reads encrypted command files from disk and writes encrypted results back, likely a fallback), CerealIron (injector that runs .NET assemblies from non-.NET processes), CerealMoth (loads a received assembly and runs a named method) and CerealBox (email collection module).

Persistence and stealth rely on DLL hijacking and .NET native image cache abuse. CerealLoader is placed as C:\Windows\System32\wbem\ncobjapi.dll, which the WMI service loads automatically, and also impersonates wbemcomn.dll in the same folder while forwarding legitimate calls. Malicious files named like genuine native images (for example Microsoft.Exchange.Search.Mdb.ni.dll) are placed in the .NET native image cache so the runtime loads them in place of the real library; one sample activates only when its parent process is Exchange's search service. CerealBox is delivered through a chain of nested Cereal components ending with CerealIron, which injects it into EdgeTransport.exe, where it wraps existing in-memory transport agent handlers rather than registering a new agent, so mail delivery is not interrupted.

CerealBox collects only messages with a .doc, .docx or .pdf attachment that match at least one hardcoded list (sender, recipient, subject substring or attachment name) and are not on ignore lists. In Romania it was configured to collect messages to or from NATO and EU institutional addresses. Matches are compressed, encrypted and staged on disk; operators exfiltrate and delete them using CerealNeuron commands. CerealNeuron listens on the Exchange server's port 443 on paths that mimic Exchange services (/owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/) and redirects requests failing integrity checks to a legitimate-looking Exchange error page. CerealRunner payloads were observed retrieving mailboxes/messages through Exchange Web Services, querying Active Directory (computers, users, groups, DNS records), running WMI queries (processes, active TCP connections), extracting LSA secrets, listing volume snapshots and listing/reading/deleting files. ESET observed no external C2 infrastructure and did not identify operator ingress IPs. No CVE is associated; the initial access vector was not described in the sources reviewed. ESET's full IOC list and white paper are published separately; no hashes or network IOCs were available in the sources reviewed for this record.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.004 LSA Secrets

Discovery

T1018 Remote System Discovery; T1087.002 Domain Account

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1620 Reflective Code Loading

Execution

T1047 Windows Management Instrumentation

Command and Control

T1071.001 Web Protocols; T1573 Encrypted Channel

Collection

T1114 Email Collection; T1560 Archive Collected Data

Persistence

T1505.002 Transport Agent

stealth

T1574.001 DLL

Remediation

Patches

• No CVE or vendor patch is associated with this activity; keep Exchange on the latest cumulative update and security updates

Immediate actions

• Hunt Exchange servers for ncobjapi.dll and wbemcomn.dll in C:\Windows\System32\wbem\ that are not the Microsoft-signed originals
• Inspect the .NET native image cache for unexpected Microsoft.Exchange.*.ni.dll files, including Microsoft.Exchange.Search.Mdb.ni.dll, with non-Microsoft signatures or unusual hashes
• Review IIS logs for unusual HTTPS requests to /owa/sdds/, /AUTODISCOVER/PROXYSERVICE/ and /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/
• Compare IOCs against the list published at https://github.com/eset/malware-ioc/tree/master/turla and ESET's white paper

Workarounds

• Rotate credentials potentially exposed via LSA secret extraction on compromised Exchange servers
• Rebuild from known-good media where compromise is confirmed

Longer-term hardening

• Monitor EdgeTransport.exe for unexpected module loads and injected .NET assemblies
• Enable EDR with in-memory .NET (CLR load) telemetry on Exchange servers
• Restrict outbound and administrative access from Exchange servers and segment them from Active Directory tiers
• Audit transport agents with Get-TransportAgent and baseline them

Affected and fixed versions

• Microsoft — Exchange Server
  Vulnerable versions: Government-operated Exchange servers compromised in Kazakhstan and Romania (specific versions not stated in sources reviewed)

Timeline

• 2004-01-01 Turla activity dates back to at least 2004 per ESET (year only; month/day set to 01-01 as a placeholder for sorting)
• 2017-11-23 UK NCSC publishes analysis of Turla's Neuron and Nautilus tools, the origin of the Neuron name reused for CerealNeuron
• 2025-11-28 Cereal toolset found on an Exchange server at a Kazakh government organization
• 2025-12-23 Romanian government organization compromised; CerealBox configured to collect mail to or from NATO and EU institutional addresses
• 2026-01-15 ESET notes a surge of Turla activity in Kazakhstan, the day after Old New Year
• 2026-11-10 ESET Research publishes 'Exchange for breakfast: Turla's Cereal tricks are not for kids' with white paper and IOCs on GitHub; BleepingComputer reports the same day

Sources cited

• MITRE ATT&CK Group G0010: Turla MITRE · Advisory · 2026-11-10
• NCSC: Turla group using Neuron and Nautilus tools alongside Snake malware NCSC (UK) · Advisory · 2017-11-23
• Exchange for breakfast: Turla's Cereal tricks are not for kids ESET WeLiveSecurity · Research · 2026-11-10
• ESET white paper: Turla Cereal tricks web-assets.esetstatic.com · Research · 2026-11-10
• ESET: Turla LightNeuron white paper web-assets.eset.com · Research · 2019-05-01
• ESET malware-ioc repository (Turla) GitHub · Code repository · 2026-11-10
• Turla hackers use new Cereal malware to spy on govt Exchange servers BleepingComputer · News · 2026-11-10

More in apt

• North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains
• CopperDragon Sparrow Framework: SilentDelivery, OceanGate and DarkWire Campaigns (China-nexus)
• North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)
• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

More from Turla

• ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise
• Turla (Snake/Uroburos) Exploits SharePoint Flaw to Breach French Justice-Sector Server
• Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military
• Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088
• Kazuar P2P Botnet Evolution — Secret Blizzard (Russia FSB Center 16) Modular Espionage Implant with Kernel/Bridge/Worker Architecture
• State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database Exfiltration, Infamous Chisel Android Malware (APT44/Sandworm, Turla, UNC5792, UNC4221, UNC1151)