Russia-aligned cyber-espionage group Turla used a newly documented toolset called Cereal to collect selected messages from Microsoft Exchange servers at government organizations in Kazakhstan and Romania, according to research published by ESET on November 10. In Romania, one component was configured to identify emails sent to or received from NATO and European Union institutional addresses.
ESET said it first found the toolset on a Kazakh government Exchange server in November 2025 and later identified the same tools at a Romanian government organization compromised in December 2025. The researchers attributed Cereal to Turla with high confidence, citing the use of another component publicly linked to the group and similarities to older Turla malware. The group is widely assessed to be part of Russia’s Federal Security Service, ESET said in its research report.
Cereal is a modular .NET toolset designed to run on Exchange servers, execute commands in memory and collect selected email messages. ESET said it found no separate attacker-controlled command-and-control infrastructure. Instead, a compromised Exchange server was reused to receive commands and act as the control point, allowing malicious requests to blend in with normal Exchange traffic.
The email-collection component, named CerealBox, is injected into Exchange’s transport service and hooks existing mail-processing routines rather than registering a new transport agent. It filters messages using sender, recipient, subject and attachment criteria, then stages selected emails for later retrieval while normal mail delivery continues. ESET described the technique as a novel way to intercept Exchange mail flow.
ESET did not identify the government agencies by name or disclose how many messages were collected. The company said the Romanian deployment was configured to collect communications involving NATO and EU addresses, while the Kazakh deployment used the same toolset for long-term espionage against a government organization.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
