ESET links Cereal toolset to Turla in Romanian breach
Original title: ESET Links Cereal to Turla in Romanian Server Breach Case — Defense News
CerealBox copied NATO and EU Word and PDF emails from servers ESET says were compromised in December 2025.
ESET said servers of a Romanian government institution were compromised in December 2025. Malware selected emails related to NATO and the European Union and stored copies for later retrieval. ESET linked the Cereal toolset to Turla with high confidence. One component, CerealBox, used filters to select Word or PDF attachments sent to NATO and EU institutional addresses, then compressed and encrypted copies.
Unconfirmed: ESET’s high-confidence Cereal-to-Turla link and the common view that Turla is tied to Russia’s FSB are attributions, not independently confirmed here.
- ESET dates the compromise to December 2025.
- CerealBox targeted NATO and EU institutional addresses.
- Selected Word and PDF attachments were compressed and encrypted.
- ESET’s Cereal-to-Turla link is high confidence.
Impact: NATO and EU emails copied from government servers
- Threat actors
- Turla
- Organizations
- ESETNATOEuropean Union
From the original article
2 min read at databreaches.netUA News reports: Slovak cybersecurity company ESET said that servers of a Romanian government institution were compromised in December 2025. The malware selected emails related to NATO and the European Union and created copies of them for later retrieval by the attackers. Defense News reported the attack.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.