Turla
A Russian espionage group that agencies tie to the FSB and that has run the Snake implant for around 20 years. In November 2026 ESET reported Cereal, a new toolset that hides inside Microsoft Exchange to read government email.
Threat actor profile. Last reviewed 11 November 2026.
Why It Matters
Turla is one of the longest-running espionage operations. The FBI, NCSC-UK and partners attribute the Snake implant to a unit within Center 16 of Russia's FSB, which also operates the Turla toolset. Snake development began in late 2003, and its infrastructure has been found in more than 50 countries.3
The NCSC has called the group out before. In 2019 it said, with the NSA, that Turla had taken over tools and infrastructure from suspected Iran-based groups, reaching more than 35 countries in a way that could make its attacks look Iranian.2 That habit of hiding behind others is worth remembering when attribution looks simple.
The newest activity targets email. On 10 November 2026 ESET reported Cereal, a toolset running inside on-premises Microsoft Exchange at government bodies in Kazakhstan and Romania. In Romania it was set to collect messages to and from NATO and EU addresses.4,6
Cereal shows the group investing in tools that live entirely inside Exchange, with no outside server to block. Any organisation that still runs on-premises Exchange and handles government, defence or diplomatic correspondence should monitor its mail servers as closely as its domain controllers.
How It Attacks
Based on ESET's Cereal research and the 2023 Snake advisory.6,1,3 ESET did not say how the attackers first got in, so the first step draws on ATT&CK.5
- 1
Get In
Has used watering holes, spearphishing links and local accounts that share the same password across a network.
- 2
Load Inside Exchange
The Cereal loader sits in system folders and the .NET native image cache under Exchange-like names, so Exchange loads it in place of legitimate files.
- 3
Listen Quietly
CerealNeuron waits for encrypted requests on paths that look like Outlook Web Access, Autodiscover and ActiveSync. Anything else gets a normal Exchange error page.
- 4
Run Commands in Memory
Small .NET programs pull mailboxes, query Active Directory, extract stored credentials and read or delete files.
- 5
Pick Out the Right Email
CerealBox injects into EdgeTransport.exe and copies messages with Word or PDF attachments that match chosen senders, recipients or subjects.
- 6
Stage and Collect
Messages are compressed, encrypted and stored on the server for collection through the same disguised traffic. ESET saw no outside command server.
Key Techniques
Selected from the group's ATT&CK v20 entry.5 ATT&CK lists many more, and a technique can sit under more than one tactic.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1189 | Drive-by Compromise | Initial Access | Uses watering hole attacks on websites its targets visit. |
| T1566.002 | Spearphishing Link | Initial Access | Has lured targets with links to a spoofed Adobe domain. |
| T1078.003 | Local Accounts | Initial Access | Abuses local accounts that share a password across the network. |
| T1059.001 | PowerShell | Execution | Runs PowerShell, including scripts loaded straight into memory. |
| T1546.003 | Windows Management Instrumentation Event Subscription | Persistence | Uses WMI event filters and consumers to persist. |
| T1018 | Remote System Discovery | Discovery | Uses net view and net group to find domain controllers and Exchange servers. |
| T1025 | Data from Removable Media | Collection | Collects files from USB drives. |
| T1090.001 | Internal Proxy | Command and Control | Uses compromised internal systems as proxies to its command servers. |
| T1102 | Web Service | Command and Control | Has used Pastebin, Dropbox and GitHub for command and control. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Has sent stolen files to OneDrive and 4shared. |
Tools Observed
Cereal Toolset (ESET, November 2026)
Named by Governments
Public Tools It Has Adapted
From ESET's research, the Snake advisory, the 2019 NCSC statement and ATT&CK.6,1,3,2,5 Neuron and Nautilus were taken from suspected Iran-based groups. The public tools have legitimate uses, so a match alone does not prove compromise.
Vulnerabilities
The sources we reviewed do not tie a CVE to the Cereal activity, and ESET did not describe how the attackers got in.6,1 The Snake advisory notes that its mitigations target persistence and hiding, not first access.3
Keeping on-premises Exchange supported and patched still reduces the ways in.
Key Events
Snake development begins in late 2003 under the name Uroburos, and operations start around 2004.3
The NCSC and NSA say Turla took over Iranian-linked tools and infrastructure, reaching more than 35 countries.2
The FBI, NCSC-UK and partners publish their Snake advisory and attribute it to FSB Center 16.3
ESET finds Cereal at a government body in Kazakhstan on 28 November.6
A Romanian government agency is compromised on 23 December.6,1
ESET publishes its Cereal research on 10 November.4
Warning Signs
Drawn from ESET's reporting and the Snake advisory.6,1,3 None of these proves an attack alone, but each deserves a quick check.
- Native image files named like Exchange components that you cannot account for, such as Microsoft.Exchange.Search.Mdb.ni.dll
- Unexpected ncobjapi.dll or wbemcomn.dll files in C:\Windows\System32\wbem
- Encrypted-looking requests to Exchange paths such as /owa/sdds/ or /autodiscover/proxyservice/
- Compressed or encrypted files building up on Exchange servers
- Code running inside EdgeTransport.exe that does not belong to a registered transport agent
- Snake host artefacts such as comadmin.dat, or WerFault.exe files with unusual icon sizes
- net view or net group queries for domain controllers and Exchange servers from unusual hosts
Defences That Matter
Treat Exchange as a Crown Jewel
- Check ESET's published indicators against your Exchange servers.1
- Baseline files in Exchange folders and the .NET native image cache, and alert on change.
- Move to Exchange Online, or keep on-premises Exchange supported and patched.
Look in Memory
- Memory analysis is the most effective way to find Snake, according to the joint advisory.3
- Run EDR on Exchange servers and domain controllers, not only on laptops.
Recover Credentials Cleanly
- Change credentials from a clean system, because Snake includes keylogging.3
- Avoid reusing similar passwords, separate user and privileged accounts and use phishing-resistant MFA.3
Be Ready to Respond
- Run your incident response plan if you suspect compromise.3
- Agree in advance who decides whether to rebuild a compromised mail server.
Would You Spot a Spy Inside Your Mail Server?
We can hunt for the techniques in this profile on your Exchange and identity systems, then help you close the gaps.
Sources
- BleepingComputer: Turla hackers use new Cereal malware to spy on govt Exchange servers, 10 November 2026
- NCSC: UK National Cyber Security Centre updates on the Turla Group, 21 October 2019
- FBI, NSA, CISA, NCSC-UK and partners: Hunting Russian Intelligence “Snake” Malware, AA23-129A, 9 May 2023
- ESET via GlobeNewswire: Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails, 10 November 2026
- MITRE ATT&CK: Turla (G0010), group version 5.1, ATT&CK v20
- Help Net Security: Turla's Cereal malware turns victims' Exchange servers into spy hubs, 10 November 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.