Turla's Cereal toolset collects NATO and EU mail from government Exchange
Original title: Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails
ESET names government victims in Kazakhstan and Romania and says those servers served as command and control.
ESET says Russia-linked Turla, also known as Snake and Uroburos, deployed a toolset called Cereal on compromised Microsoft Exchange servers at two national governments. At the Romanian victim, Cereal was set to collect email sent to or from NATO and European Union addresses. Payloads stayed encrypted, commands arrived as .NET assemblies, and collection ran inside Exchange processes, with no external command-and-control. ESET published indicators on November 10 but does not say how the servers were first compromised.
Unconfirmed: Initial access is undescribed; suggested links to drones and deportations are ESET's interpretation.
- ESET first saw Cereal in Kazakhstan on November 28, 2025.
- The Romanian victim was found about a month later.
- ESET attributes Cereal to Turla with high confidence.
- About 70% of Turla targets since 2022 were former Soviet-aligned states, per ESET.
- The group is widely assessed to be part of Russia's FSB.
Impact: selected government email collected, including NATO and EU messages
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- 1.Review Exchange servers against the Cereal indicators ESET published
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Malware
- Cereal
- Organizations
- ESET
- Countries
- RussiaKazakhstanRomania
From the original article
2 min read at infosecurity-magazine.com
Turla used compromised Exchange servers to collect NATO and EU-linked emails
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.