Turla uses government Exchange servers to command and steal mail
ESET found Turla’s Cereal espionage toolset on Microsoft Exchange servers at two government organizations in Kazakhstan and Romania in late 2025: the first discovery was Nov. 28, and ESET identified the Romanian victim about a month later. There, the collection module was set to copy messages sent to or received from NATO and EU addresses. ESET could not determine how the servers were first compromised.
Cereal makes the compromised Exchange server both a command channel and a collection point: operators send commands to it instead of using attacker-owned command-and-control (C2) infrastructure. As Exchange processes mail, the malware checks messages against its targets and copies matches while originals continue through normal delivery. Users can see mail working as expected even as selected correspondence is stolen.
For government systems carrying sensitive exchanges with alliance partners, ordinary delivery can conceal collection before messages leave the organization. Because commands and theft run through the same server, monitoring only for external C2 traffic may leave the operation—and the scope of copied mail—unresolved.
New malware doesn't call home, it turns your Exchange server into its home
A new espionage toolkit dubbed ‘Cereal’ hides inside Microsoft Exchange, intercepts email in transit, and receives commands without relying on external attacker infrastructure.
Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.