Turla’s Cereal toolkit found on two governments’ Exchange servers
Original title: Exchange for breakfast: Turla’s Cereal tricks are not for kids
The Romanian deployment collected NATO and EU email, and the victim Exchange server itself was the command channel.
ESET says it found a previously undocumented modular .NET toolset, Cereal, on a Microsoft Exchange server of a governmental organization in Kazakhstan on November 28, 2025. The same tools appeared at a Romanian governmental organization compromised on December 23, 2025, and were set to collect mail involving NATO and EU addresses. Cereal executes commands in memory and uses the victim Exchange server as command-and-control. ESET attributes the toolset to Turla with high confidence.
Unconfirmed: Links to Kazakh deportations and Romanian drone incidents are ESET’s interpretation, not confirmed operator intent.
- Kazakhstan’s government Exchange server was found compromised on November 28, 2025.
- Romania’s governmental organization was compromised on December 23, 2025.
- CerealBox there collected messages involving NATO and EU addresses.
- Operators delivered commands as separately compiled executables, with no external C&C.
- ESET links Cereal to Turla through another Turla component and older tooling.
Impact: selected email collection and in-memory command execution
| Product | Affected |
|---|---|
| Microsoft Exchange | — |
- Vendors
- Microsoft
- Products
- Exchange
- Threat actors
- Turla
- Organizations
- NATOEuropean UnionFSB
- Countries
- KazakhstanRomaniaRussia
From the original article
12 min read at welivesecurity.com
ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated . NET execution tricks
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.