Turla’s Cereal toolset stole government Exchange mail in Kazakhstan and Romania

9 sources · 9 articlesFirst reported Nov 10, 2026 · 10:00 UTCUpdated Nov 10, 2026 · 20:40 UTC (5h ago)1

What's new

November 10: Security Affairs adds that only the first loader stays on disk, other modules unpack in memory, and CerealRunner carries compiled tasks.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ESET says Turla’s Cereal toolset collected selected Kazakh and Romanian government Exchange mail without external command servers.

ESET says Russia-aligned Turla, also known as Snake and Uroburos and assessed by multiple governments as part of the FSB, deployed a modular .NET toolset named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. It was found in Kazakhstan on November 28, 2025, and a Romanian system was compromised on December 23, 2025, with collection aimed at NATO and EU mail, including nato.int and europa.eu. CerealBox injects into EdgeTransport.exe and copies messages with document or PDF attachments matching hardcoded rules. Encrypted commands arrive as ordinary Exchange web traffic and mostly run in memory; ESET says there were no external command servers, operator IPs could not be identified, and initial access, stolen-mail volume, and any specific Exchange vulnerability remain unknown. ESET published indicators on November 10, 2026.

Key facts

ESET attributes Cereal to Turla with high confidence and published indicators on November 10, 2026.
Kazakhstan detection: November 28, 2025; Romania compromised December 23, 2025.
CerealBox copies .doc, .docx, and .pdf messages matching hardcoded rules.
No external command servers; the victim Exchange server is the control point.
Initial access, stolen-mail volume, and any Exchange vulnerability remain unknown.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Nov 28, 2025ESET finds Cereal on a Kazakh government Exchange server · ESET via Help Net Security
Dec 23, 2025Romanian government system compromised and set for NATO and EU mail · BleepingComputer
Jan 15, 2026Kazakh Cereal activity surged, according to ESET · Help Net Security
Nov 10, 2026ESET publishes the Cereal report and indicators of compromise · Cyber Security News

What each outlet adds

beyond the shared facts

Help Net SecurityKazakh activity surged January 15, 2026; loader DLL names and URL paths.
BleepingComputerCerealHermit can read commands from disk as a fallback.
GBHackersRomanian filters included nato.int and europa.eu; conceptual LightNeuron link.
The RecordAbout 70% of Turla country targets since 2022 were former Soviet-linked states.
Security AffairsOnly the first loader is on disk; CerealRunner carries compiled tasks.

Vendors: Microsoft
Products: Exchange Microsoft Exchange
Threat actors: Turla
Malware: Cereal CerealNeuron CerealHermit CerealRunner CerealBox CerealLoader
Victims: Romanian government Kazakhstan government Kazakhstan national government Romania national government Kazakh governmental organization Romanian governmental organization Kazakh government organization Romanian government organization Government of Kazakhstan Romanian government agency
Organizations: ESET CISA NATO European Union FSB
Countries: Kazakhstan Romania Russia

Coverage

oldest first · one row per article · UTC

Nov 10, 10:00 UTC · 15h ago CyberScoopFirst report
Turla’s Cereal toolset stole Kazakh and Romanian government email
ESET found no external command servers; Romania’s copy was set to collect mail involving the EU and NATO.
Nov 10, 10:00 UTC · 15h ago Help Net Security
Turla Cereal malware copies government email from Exchange servers
ESET found the .NET toolset in Kazakhstan on November 28, 2025, and in Romania on December 23, 2025.
Nov 10, 10:04 UTC · 15h ago BleepingComputer
Turla uses Cereal malware to spy on government Exchange servers
ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.
Nov 10, 10:07 UTC · 15h ago The Hacker News
Turla uses Cereal malware to steal email from government Exchange servers
ESET says the modular .NET toolset hit two government entities in Kazakhstan and Romania in late 2025, with no external C2.
Nov 10, 11:30 UTC · 14h ago GBHackers
Turla’s Cereal toolkit turns Exchange servers into surveillance platforms
ESET found the .NET toolset at government organizations in Kazakhstan and Romania and attributes it to Turla with high confidence.
Nov 10, 13:00 UTC · 12h ago The Record
Turla used Cereal malware to steal mail from two governments
ESET says Cereal hid in Microsoft Exchange and collected Romanian mail with NATO and EU officials.
Nov 10, 13:42 UTC · 12h ago Cyber Security News
Turla uses Cereal malware to collect email from Exchange servers
ESET found the toolset at government organizations in Kazakhstan and Romania, with activity dating to late 2025.
Nov 10, 14:30 UTC · 11h ago Infosecurity Magazine
Turla's Cereal toolset collects NATO and EU mail from government Exchange
ESET names government victims in Kazakhstan and Romania and says those servers served as command and control.
Nov 10, 20:40 UTC · 5h ago Security Affairs
Turla’s Cereal toolset found on government Exchange servers
ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.