ESET Uncovers 'Cereal' Malware Turning Exchange Servers Into Espionage Platforms

ESET has documented Cereal, a modular toolkit that runs in memory on compromised Microsoft Exchange servers to collect selected emails and map victim organizations for long-term cyberespionage. Nation-state actors are currently using it against government bodies, and the toolkit leaves little on disk and uses no external command-and-control infrastructure. Researchers and analysts warn that such techniques often spread to criminal groups over time.

Why it matters: IT and security teams running on-premises Exchange should review server hardening, monitor for in-memory .NET execution and unusual email collection, and check for passive backdoors that lack external C2 traffic.