Turla’s Cereal toolset stole Kazakh and Romanian government email
Original title: Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
ESET found no external command servers; Romania’s copy was set to collect mail involving the EU and NATO.
ESET says Turla, assessed by multiple governments as part of Russia’s FSB, used a modular toolset nicknamed Turla’s Cereal against Microsoft Exchange. It was found on a Kazakh government server on November 28, 2025, and a month later at a Romanian government agency configured for EU and NATO mail. CerealNeuron stays on the server and passively accepts commands disguised as ordinary Exchange web traffic, with most execution in memory. The report was released Tuesday.
Unconfirmed: The article says Turla compromised governments around the world; the named Cereal victims are Kazakhstan and Romania.
- ESET says the toolset has no external command-and-control infrastructure.
- Commands use encrypted payloads and mostly run in memory.
- MITRE says Turla has hit victims in more than 50 countries.
- The EU cited Turla espionage in July sanctions, separate from this finding.
Impact: Selected government email and organizational intelligence copied from Exchange
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Malware
- CerealCerealNeuron
- Organizations
- ESETFSBEuropean UnionNATO
- Countries
- KazakhstanRomaniaRussia
From the original article
3 min read at cyberscoop.com
Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report. The post Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments appeared first on CyberScoop.
By djohnson · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.