Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Turla used Cereal on Kazakhstan and Romania government Exchange servers

12 sources · 12 articlesFirst reported Updated ()
What's new

November 11: DataBreaches restated ESET’s high-confidence Turla link and CerealBox’s Word and PDF collection in Romania, without new technical findings.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ESET says Turla ran the Cereal toolset on government Exchange servers in Kazakhstan and Romania, using the servers themselves as command channels.

ESET says it found a previously undocumented modular .NET toolset, Cereal, on a Microsoft Exchange server of a governmental organization in Kazakhstan on November 28, 2025, and at a Romanian governmental organization compromised on December 23, 2025. ESET attributes Cereal to Russia-aligned Turla with high confidence. The compromised Exchange server was the command channel; ESET found no external command infrastructure. In Romania, collection targeted messages involving NATO and EU addresses, including Word and PDF attachments. Initial access was not determined, and no specific Exchange vulnerability was confirmed.

Key facts
  • CerealBox injected into EdgeTransport.exe without registering a new transport agent.
  • Romanian filters included NATO and EU addresses such as nato.int and europa.eu.
  • Commands can query Active Directory, use WMI, extract credentials, and read or delete files.
  • CerealHermit can read encrypted commands from disk and has no network functions.
  • Operators used DLL search-order hijacking and the .NET native image cache.
  • ESET published indicators of compromise on November 10, 2026.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 28, 2025ESET finds Cereal on a Kazakh government Exchange server. · ESET WeLiveSecurity
  2. Dec 23, 2025Romanian government organization is compromised, ESET says. · ESET WeLiveSecurity
  3. Nov 10, 2026ESET publishes the Cereal report and indicators of compromise. · Cyber Security News

What each outlet adds

beyond the shared facts
  • ESET WeLiveSecurityHigh-confidence Turla link via another component and older tooling.
  • BleepingComputerNo new transport agent; CerealHermit is a disk-based fallback.
  • Security AffairsCommands wait on Outlook Web Access, Autodiscover, and ActiveSync paths.
  • Cyber Security NewsDLL search-order hijacking and the .NET native image cache.
  • The RecordLinks Turla to Russia’s FSB and cites the 70% targeting figure.
Vendors
Microsoft
Products
ExchangeMicrosoft ExchangeOutlook Web AccessActiveSync
Threat actors
Turla
Malware
CerealCerealNeuronCerealHermitCerealRunnerCerealBoxCerealLoader
Victims
Romanian governmentKazakhstan governmentKazakhstan national governmentRomania national governmentKazakh governmental organizationRomanian governmental organizationKazakh government organizationRomanian government organizationGovernment of KazakhstanRomanian government agency
Organizations
ESETCISANATOEuropean UnionFSB
Countries
KazakhstanRomaniaRussia

Coverage

oldest first · one row per article · UTC
  1. · 1d ago ESET WeLiveSecurityFirst report

    Turla’s Cereal toolkit found on two governments’ Exchange servers

    The Romanian deployment collected NATO and EU email, and the victim Exchange server itself was the command channel.

  2. · 1d ago CyberScoop

    Turla’s Cereal toolset stole Kazakh and Romanian government email

    ESET found no external command servers; Romania’s copy was set to collect mail involving the EU and NATO.

  3. · 1d ago Help Net Security

    Turla Cereal malware copies government email from Exchange servers

    ESET found the .NET toolset in Kazakhstan on November 28, 2025, and in Romania on December 23, 2025.

  4. · 1d ago BleepingComputer

    Turla uses Cereal malware to spy on government Exchange servers

    ESET found the toolset at agencies in Kazakhstan and Romania, where it collected selected NATO and EU correspondence.

  5. · 1d ago The Hacker News

    Turla uses Cereal malware to steal email from government Exchange servers

    ESET says the modular .NET toolset hit two government entities in Kazakhstan and Romania in late 2025, with no external C2.

  6. · 1d ago GBHackers

    Turla’s Cereal toolkit turns Exchange servers into surveillance platforms

    ESET found the .NET toolset at government organizations in Kazakhstan and Romania and attributes it to Turla with high confidence.

  7. · 1d ago The Record

    Turla used Cereal malware to steal mail from two governments

    ESET says Cereal hid in Microsoft Exchange and collected Romanian mail with NATO and EU officials.

  8. · 1d ago Cyber Security News

    Turla uses Cereal malware to collect email from Exchange servers

    ESET found the toolset at government organizations in Kazakhstan and Romania, with activity dating to late 2025.

  9. · 1d ago Infosecurity Magazine

    Turla's Cereal toolset collects NATO and EU mail from government Exchange

    ESET names government victims in Kazakhstan and Romania and says those servers served as command and control.

  10. · 1d ago Security Affairs

    Turla’s Cereal toolset found on government Exchange servers

    ESET found the passive backdoor in Kazakhstan and Romania, with the victim Exchange server acting as the control point.

  11. · 15h ago CSO Online

    Turla’s Cereal toolkit collects mail from compromised Exchange servers

    ESET found no external command server; the passive backdoor waits on paths that resemble ordinary Outlook web traffic.

  12. · 6h ago DataBreaches.net

    ESET links Cereal toolset to Turla in Romanian breach

    CerealBox copied NATO and EU Word and PDF emails from servers ESET says were compromised in December 2025.