Turla uses government Exchange servers to command and steal mail
ESET found Turla’s Cereal espionage toolset on Microsoft Exchange servers at two government organizations in Kazakhstan and Romania in late 2025: the first discovery was Nov. 28, and ESET identified the Romanian victim about a month later. There, the collection module was set to copy messages sent to or received from NATO and EU addresses. ESET could not determine how the servers were first compromised.
Cereal makes the compromised Exchange server both a command channel and a collection point: operators send commands to it instead of using attacker-owned command-and-control (C2) infrastructure. As Exchange processes mail, the malware checks messages against its targets and copies matches while originals continue through normal delivery. Users can see mail working as expected even as selected correspondence is stolen.
For government systems carrying sensitive exchanges with alliance partners, ordinary delivery can conceal collection before messages leave the organization. Because commands and theft run through the same server, monitoring only for external C2 traffic may leave the operation—and the scope of copied mail—unresolved.
A new espionage toolkit dubbed ‘Cereal’ hides inside Microsoft Exchange, intercepts email in transit, and receives commands without relying on external attacker infrastructure.
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report.
ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks.