Summary
- ESET attributes the Cereal toolkit to Russia-aligned Turla with high confidence, based on technical evidence.
- The malware operated inside compromised government Exchange servers, collecting selected correspondence without visibly interrupting delivery.
- Romanian targeting included messages involving NATO and EU addresses, but the research does not establish breaches of those institutions themselves.
Russian-aligned cyber-espionage operators compromised government Microsoft Exchange servers in Romania and Kazakhstan using previously undocumented malware capable of intercepting selected correspondence with NATO and European Union institutions.
Researchers at ESET identified the modular toolkit, named Cereal, during investigations into two government intrusions. Their findings, published on 10 November, attribute the activity with high confidence to Turla, a long-running espionage group widely assessed to be associated with Russia’s Federal Security Service.
The malware was first identified at a government organisation in Kazakhstan on 28 November 2025. Following improvements to its detection methods, ESET subsequently identified the same toolkit at a Romanian government organisation compromised on 23 December 2025.
In the Romanian case, one component was configured to select messages sent to or received from NATO and EU addresses. ESET’s research does not establish that the institutions themselves were breached; the observed compromise involved the government organisation’s Exchange infrastructure.
The findings disclose historical activity rather than a newly confirmed intrusion in November 2026. Neither government’s affected organisation has been publicly named in the research.
Malware concealed within Exchange processes
Cereal combines several specialised components that allow its operators to execute code, examine internal systems and collect communications while minimising the malware’s visibility on disk.
Unlike a conventional backdoor that repeatedly contacts an external command server, one of Cereal’s principal components receives instructions through the compromised Exchange server itself. The operators can communicate through requests resembling legitimate Exchange web services, reducing their dependence on easily identified external infrastructure.
ESET found no separate attacker-controlled command-and-control infrastructure in the observed operations. This does not establish that no external communications occurred, but it indicates that the compromised Exchange systems performed functions normally associated with the attackers’ own control servers.
The toolkit’s email collection component, CerealBox, was injected into the Exchange transport process. Rather than installing a conventional transport agent that administrators might identify through standard configuration checks, it interacted with agents already loaded into the service.
That allowed the malware to examine messages passing through the system and select those matching configured criteria. ESET describes filtering involving sender and recipient details, subject lines and attachment names, with particular attention to messages containing common document formats.
Selected messages were packaged for subsequent retrieval, while the original correspondence continued through the normal delivery process. The absence of an obvious interruption would make the compromise more difficult to detect through ordinary service availability monitoring.
Long-term intelligence collection
The researchers identified additional components designed to execute commands in memory, inspect Windows systems and obtain information about users, computers and network resources. Several employed unusual .NET execution techniques and mechanisms for loading malicious code within legitimate processes.
These capabilities extend the operation beyond passive message interception. Access to an Exchange server within a government environment can provide a position from which operators investigate internal relationships, identify accounts and assess opportunities for continued access.
For organisations handling diplomatic or defence correspondence, the consequences of mailbox compromise depend on the information available to the affected system. Messages exchanged with international institutions can contain sensitive operational context even when the institutions receiving or sending those messages have not themselves been compromised.
ESET’s attribution rests on technical relationships between Cereal and previously documented Turla capabilities, including the use of another component associated with the group. That assessment should be distinguished from independent confirmation by a government intelligence agency concerning the two specific intrusions.
Turla has been active for more than two decades and has repeatedly targeted diplomatic, government and defence-related organisations. The group’s reported emphasis on persistent access and intelligence collection is consistent with the observed use of Cereal, although the researchers have not publicly established the full scope of information obtained.
The Romanian compromise also demonstrates a limitation of perimeter-focused security assessment. An internet-facing email service may remain operational and continue passing legitimate traffic while malicious components operate inside its processes.
Technical controls that rely principally on identifying known malicious destinations may provide incomplete visibility where the compromised server itself becomes the operators’ communication endpoint. Examination of abnormal process behaviour, in-memory execution and unexpected access to Exchange transport functions can therefore form part of investigating similar activity.
ESET has published technical analysis and indicators associated with the toolkit. Its investigation establishes two observed government compromises and a particular focus on NATO and EU correspondence, but does not determine the complete duration of access or the total volume of messages obtained.
