Turla used Cereal malware to steal mail from two governments
Original title: Russian hackers compromised government email servers to steal NATO, EU correspondence
ESET says Cereal hid in Microsoft Exchange and collected Romanian mail with NATO and EU officials.
ESET attributed the intrusions to Turla, which it links to Russia's FSB. The group monitored traffic on compromised Microsoft Exchange servers and captured selected messages. Researchers found the toolkit in November 2025 on a Kazakh government server and later at a Romanian government organization. Initial access and the volume of stolen mail remain unknown.
Unconfirmed: ESET could not confirm initial access, data volume, or whether the Kazakhstan intrusion targeted dissidents.
- CerealBox sat inside an Exchange service that processes email traffic.
- Commands went through the victims' Exchange servers, not outside infrastructure.
- ESET said Turla has used variations of that hub technique before.
- About 70% of Turla country targets since 2022 were former Soviet-linked states.
Impact: stolen government email, including NATO and EU correspondence
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Organizations
- ESETNATOEuropean UnionFSB
- Countries
- RomaniaKazakhstanRussia
From the original article
2 min read at therecord.mediaRussian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.