ESET Says Turla Used Cereal on Government Email Servers

ESET says Turla used a previously undocumented toolset called Cereal on compromised government Microsoft Exchange servers in Kazakhstan and Romania in late 2025, collecting selected email and using the servers to manage its operations. The security company attributed the activity to Turla with high confidence, but said it could not establish how the attackers gained initial access or how much information they obtained.

ESET first identified Cereal on a Kazakhstan government server on November 28, 2025, then found it at a Romanian government organization compromised on December 23, 2025. The toolset was configured in Romania to collect messages involving addresses belonging to NATO and the European Union, according to ESET’s analysis. The reports do not establish that the same targeting settings were used in Kazakhstan.

Rather than relying on separate attacker-controlled command servers, Cereal used the victims’ Exchange systems as operational hubs. ESET said the malware listened for commands through web requests made to resemble ordinary Exchange traffic, then executed commands in memory. Researchers said this approach reduced reliance on external infrastructure that defenders...