Science & Tech · Cybersecurity · 47 mins ago
Turla uses Cereal malware to spy on government Exchange servers
Russian-linked hacking group Turla used new malware called Cereal to spy on government organizations’ Microsoft Exchange servers.
ESET researchers first found the toolset in late 2025 at a government body in Kazakhstan, then found it at a Romanian agency a month later.
In Romania, the malware selectively collected emails based on sender, recipient, subject and attachments, including Word documents and PDFs; some targeted correspondence involved NATO and the European Union.
Turla is a cyber-espionage group active for more than two decades and linked to Russia’s Federal Security Service.
Cereal can run commands inside the server’s memory, including retrieving emails, searching for user accounts and extracting stored credentials, without disrupting normal email delivery.
The setup is designed for long-term, stealthy spying, and ESET found no external command-and-control system in the campaign; the compromised server served as the control point.
ESET has shared indicators of compromise that organizations can use to check for signs of the malware.
Turla used a modular malware toolset called Cereal to spy on Microsoft Exchange servers at government organizations in Kazakhstan and Romania.
ESET found the toolset in Kazakhstan on November 28, 2025, and later identified it at a Romanian government agency compromised on December 23, 2025.
In Romania, the malware was configured to collect selected emails sent to or received from NATO and European Union addresses.
Cereal can inspect email as it moves through Exchange while allowing normal delivery to continue.
The compromised Exchange server also served as the operators’ command point, with no external command-and-control infrastructure observed by ESET.
- Who
- Turla, a cyberespionage group linked to Russia’s Federal Security Service, according to the sources.
- What
- The group used the Cereal malware toolset to spy on government Microsoft Exchange servers and collect selected emails.
- When
- ESET found the toolset in Kazakhstan on November 28, 2025, and at a Romanian agency compromised on December 23, 2025.
- Where
- Government organizations in Kazakhstan and Romania.
- Why
- The toolset was used for cyberespionage and to collect selected emails and other information. The sources do not state a more specific motive.
This story does not have two clearly opposing sides.
ESET found the Cereal toolset on a compromised Exchange server at a government body in Kazakhstan.
A Romanian government agency was compromised with the same toolset.
Activity in Kazakhstan surged, according to Help Net Security.
The three articles reported on ESET’s findings.
- Toolset
- Cereal
- First reported discovery
- November 28, 2025, in Kazakhstan
- Romanian compromise
- December 23, 2025
- Email targets in Romania
- Messages sent to or received from NATO and EU addresses
- Main backdoor
- CerealNeuron
- Mail-flow component
- CerealBox injects into Exchange’s EdgeTransport.exe process
3 sources
What people are saying
One of the most interesting aspects of this toolset is what we did not find: external command and control infrastructure
On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox.
The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers — they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft
The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands