# Turla (Secret Blizzard) Cereal modular .NET toolset targets government Microsoft Exchange servers

> ESET reports that Russian state-backed Turla (Snake, Secret Blizzard, Waterbug) deployed the modular .NET 'Cereal' toolset on Exchange servers at government bodies in Kazakhstan and Romania. The malware runs in memory inside legitimate processes, selectively collects email, and uses the compromised Exchange server as the only control point; no external C2 was observed.

- **Published:** 2026-11-10T10:18:36Z
- **Last reviewed:** 2026-11-10T10:18:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5635
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5635.png
- **ID:** TL-2026-5635
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Turla (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

ESET Research (published 2026-11-10) documents a previously undisclosed Turla toolset, dubbed Cereal, built from modular .NET components and deployed on Microsoft Exchange servers. ESET found it on a Kazakh government Exchange server on 2025-11-28 and on a Romanian government organization compromised on 2025-12-23. ESET attributes the activity to Turla, assessed as part of Russia's FSB, with high confidence, based on concurrent use of another Turla-linked component and conceptual similarities to older Turla malware (such as the Neuron family documented by NCSC in 2017).

The components are: CerealLoader (loads and runs a .NET assembly from an encrypted disk file; the only component written to disk unencrypted; uses Vtable Fixups so that native code runs before the .NET runtime and decompilers show an empty entry point), CerealRunner and CerealSprinter (carry encrypted binaries and arguments, unpack and run them in memory), CerealNeuron (passive backdoor with no built-in commands that listens for HTTPS requests and executes received CerealRunner assemblies), CerealHermit (CerealNeuron variant without network functions that reads encrypted command files from disk and writes encrypted results back, likely a fallback), CerealIron (injector that runs .NET assemblies from non-.NET processes), CerealMoth (loads a received assembly and runs a named method) and CerealBox (email collection module).

Persistence and stealth rely on DLL hijacking and .NET native image cache abuse. CerealLoader is placed as C:\Windows\System32\wbem\ncobjapi.dll, which the WMI service loads automatically, and also impersonates wbemcomn.dll in the same folder while forwarding legitimate calls. Malicious files named like genuine native images (for example Microsoft.Exchange.Search.Mdb.ni.dll) are placed in the .NET native image cache so the runtime loads them in place of the real library; one sample activates only when its parent process is Exchange's search service. CerealBox is delivered through a chain of nested Cereal components ending with CerealIron, which injects it into EdgeTransport.exe, where it wraps existing in-memory transport agent handlers rather than registering a new agent, so mail delivery is not interrupted.

CerealBox collects only messages with a .doc, .docx or .pdf attachment that match at least one hardcoded list (sender, recipient, subject substring or attachment name) and are not on ignore lists. In Romania it was configured to collect messages to or from NATO and EU institutional addresses. Matches are compressed, encrypted and staged on disk; operators exfiltrate and delete them using CerealNeuron commands. CerealNeuron listens on the Exchange server's port 443 on paths that mimic Exchange services (/owa/sdds/, /AUTODISCOVER/PROXYSERVICE/, /MICROSOFT-SERVER-ACTIVESYNC/INTEGRATED/API/) and redirects requests failing integrity checks to a legitimate-looking Exchange error page. CerealRunner payloads were observed retrieving mailboxes/messages through Exchange Web Services, querying Active Directory (computers, users, groups, DNS records), running WMI queries (processes, active TCP connections), extracting LSA secrets, listing volume snapshots and listing/reading/deleting files. ESET observed no external C2 infrastructure and did not identify operator ingress IPs. No CVE is associated; the initial access vector was not described in the sources reviewed. ESET's full IOC list and white paper are published separately; no hashes or network IOCs were available in the sources reviewed for this record.

## MITRE ATT&CK

- T1574.001 DLL
- T1505.002 Transport Agent
- T1047 Windows Management Instrumentation
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1003.004 LSA Secrets
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1114 Email Collection
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Turla CerealLoader WMI DLL Hijack — ncobjapi.dll / wbemcomn.dll in System32\wbem — Exploitation Phase** (`TL-2026-5635-SPL-001`)

Detects the CerealLoader (Turla/Secret Blizzard Cereal toolset) persistence mechanism on Exchange servers. ncobjapi.dll is written to or loaded from C:\Windows\System32\wbem\ (the genuine ncobjapi.dll lives in System32, so the WMI service search order picks up the planted copy), and wbemcomn.dll in the same folder is replaced or loaded unsigned (CerealLoader impersonates it and forwards legitimate calls). Reported by ESET on Kazakh and Romanian government Exchange servers.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.002, T1047
- **Data sources:** sysmon:EventCode=11 (FileCreate), sysmon:EventCode=7 (ImageLoad), DeviceFileEvents, DeviceImageLoadEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=11 OR EventCode=7)
| search (EventCode=11 AND (TargetFilename="*\\System32\\wbem\\ncobjapi.dll" OR TargetFilename="*\\System32\\wbem\\wbemcomn.dll") AND NOT (Image="*\\TrustedInstaller.exe" OR Image="*\\TiWorker.exe")) OR (EventCode=7 AND (ImageLoaded="*\\System32\\wbem\\ncobjapi.dll" OR (ImageLoaded="*\\System32\\wbem\\wbemcomn.dll" AND Signed!="true")))
```ncobjapi.dll is not normally present in the wbem folder; wbemcomn.dll must be Microsoft signed```
| eval stage=case(EventCode=11,"dll_written","dll_loaded")
| eval artifact=coalesce(TargetFilename, ImageLoaded)
| stats earliest(_time) as first_seen latest(_time) as last_seen values(stage) as stages values(Image) as actor_process values(Signature) as signer count as events by host, artifact
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let FileWrites = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where FolderPath contains @"\System32\wbem\"
    | where FileName in~ ("ncobjapi.dll", "wbemcomn.dll")
    | where InitiatingProcessFileName !in~ ("TrustedInstaller.exe", "TiWorker.exe")
    | project Timestamp, DeviceName, Stage = "dll_written", FileName, FolderPath, SHA256, ActorProcess = InitiatingProcessFileName, ActorCommandLine = InitiatingProcessCommandLine;
let DllLoads = DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FolderPath contains @"\System32\wbem\"
    | where FileName =~ "ncobjapi.dll"
    | project Timestamp, DeviceName, Stage = "dll_loaded", FileName, FolderPath, SHA256, ActorProcess = InitiatingProcessFileName, ActorCommandLine = InitiatingProcessCommandLine;
union FileWrites, DllLoads
| sort by Timestamp desc
```

### Sigma

```yaml
title: Turla CerealLoader WMI DLL Hijack — ncobjapi.dll / wbemcomn.dll in System32\wbem — Exploitation Phase
id: 7c1e5a42-3b9d-4f0e-9a61-2d8f4c5b7e01
status: experimental
description: Detects the CerealLoader (Turla Cereal toolset) persistence mechanism on Exchange servers. ncobjapi.dll or wbemcomn.dll written into C:\Windows\System32\wbem\ by anything other than the Windows servicing stack.
references:
    - https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/
    - https://attack.mitre.org/groups/G0010/
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1574.002
    - attack.execution
    - attack.t1047
    - attack.g0010
logsource:
    category: file_event
    product: windows
detection:
    selection_ncobjapi:
        TargetFilename|endswith: '\System32\wbem\ncobjapi.dll'
    selection_wbemcomn:
        TargetFilename|endswith: '\System32\wbem\wbemcomn.dll'
    filter_servicing:
        Image|endswith:
            - '\TrustedInstaller.exe'
            - '\TiWorker.exe'
    condition: (selection_ncobjapi or selection_wbemcomn) and not filter_servicing
falsepositives:
    - Windows servicing or cumulative updates replacing wbemcomn.dll via a servicing process other than TrustedInstaller
    - Third-party WMI repair or system-restore tools rewriting WMI repository files
level: high

```

**Known false positives:**

- Windows servicing or cumulative updates replacing wbemcomn.dll through a servicing process other than TrustedInstaller
- Third-party WMI repair or system-restore tools rewriting files in System32\wbem

**Tuning notes:** Any ncobjapi.dll inside System32\wbem is high fidelity; the wbemcomn.dll branch relies on the Sysmon Signed field, so make sure Sysmon ImageLoad (EID 7) logging covers the wbem folder. Add your patching tool's Image to the exclusion list. Scope to Exchange servers via a host lookup to reduce noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Turla Cereal Malicious .NET Native Image Cache Library (Microsoft.Exchange.*.ni.dll) — Exploitation Phase (locked: unlock with TL Creds)
- Turla Cereal .NET CLR Loaded in Non-.NET WMI and System Processes — Post-Exploitation (locked: unlock with TL Creds)
- Turla CerealBox Staged Encrypted Mail Archives Written by EdgeTransport.exe — Collection / Exfiltration Staging (locked: unlock with TL Creds)
- Exchange Transport Process Spawning Shells or Recon Tools (Turla Cereal Tradecraft) — Post-Exploitation (locked: unlock with TL Creds)
- Unsigned DLL Loaded from System32\wbem by WMI Service Hosts (CerealLoader Hijack Variant) — Persistence (locked: unlock with TL Creds)
- Exchange Transport Agent Install or Enable via PowerShell — Persistence Baseline Control (locked: unlock with TL Creds)
- Turla CerealIron / CerealBox Injection into EdgeTransport.exe — Post-Exploitation (locked: unlock with TL Creds)
- Turla CerealNeuron Passive HTTPS Listener Paths on Exchange IIS — C2 / Command Channel (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Exchange for breakfast: Turla's Cereal tricks are not for kids](https://www.welivesecurity.com/en/eset-research/exchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids/)
- [Turla hackers use new Cereal malware to spy on govt Exchange servers](https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/)
- [ESET white paper: Turla Cereal tricks](https://web-assets.esetstatic.com/wls/en/papers/white-papers/turla-cereal-tricks.pdf)
- [ESET malware-ioc repository (Turla)](https://github.com/eset/malware-ioc/tree/master/turla)
- [MITRE ATT&CK Group G0010: Turla](https://attack.mitre.org/groups/G0010/)
- [NCSC: Turla group using Neuron and Nautilus tools alongside Snake malware](https://www.ncsc.gov.uk/static-assets/documents/Turla%20group%20using%20Neuron%20and%20Nautilus%20tools%20alongside%20Snake%20malware_1.pdf)
- [ESET: Turla LightNeuron white paper](https://web-assets.eset.com/fileadmin/ESET/US/resources/white-papers/ESET_Lightneuron_WP.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5635