It’s Not You… Various Microsoft Services Are Down

Posted in Commentary with tags on November 12, 2026 by itnerd

If you’re trying to use Microsoft Teams or Microsoft Outlook, you might be in for a long afternoon.

First Microsoft definitively has a Teams outage and they are tracking the incident under TM1550488 according to this:

You can click the Tweet (X?) above for more information. But Teams isn’t the only thing that is down. I am also seeing massive instability with Microsoft Outlook. So I have to assume that Outlook is down as well. But the company is only admitting to Teams at this time. I guess we’ll have to wait until the company says more and ultimately resolves the issue.

UPDATE: Arvind Parthasarathi, CEO and Founder, CYGNVS Said This

“Everyone understands the importance of having out-of-band communications during a cyber incident, but as outages become an even more common business reality, that same principle needs to apply to any major disruption.

When core systems like email and collaboration platforms go down, organizations can lose the tools they depend on to coordinate their response. Companies need a secure, independent environment where employees, executives and external partners can continue communicating, making decisions and managing recovery. Business resilience means being prepared to operate when the technology you rely on is unavailable.”

Cyber attacks are up a third year on year according to new Check Point data

Posted in Commentary with tags on November 12, 2026 by itnerd

October set a ransomware record: 1,063 publicly claimed victims, up 35% on last October. Weekly attacks per organization eased 9% from September but sit 32% above last year, and every one of the 23 sectors Check Point tracks grew by double digits.

AI is revitalizing old methods into cheaper and faster attack tactics. n0n, a data-extortion crew that surfaced in September, took 8% of October’s published victims and landed in the top three within a month. Its operators leaned on commercial generative-AI platforms, and the way in was weak or stolen credentials, not some exotic exploit. That is the uncomfortable part:

Three other things stand out in the data:

  • Education is still the most-hit sector, at 5,934 weekly attacks per organization. Agriculture is the fastest climber, up 93% year on year to 3,218.
  • Europe grew fastest of any region at 39%, even though Africa has the highest volume.
  • 1 in 35 enterprise GenAI prompts carries a high risk of sensitive-data leakage, up from 1 in 43 in August, and 90% of organizations using GenAI tools are exposed.

Full breakdown by sector, region and ransomware group is in the blog post:https://blog.checkpoint.com/research/october-2026-cyber-threat-landscape-record-ransomware-rising-genai-risk-and-an-ai-powered-newcomer/

ServiceNow Autonomous CRM Engine enables fast CRM deployments that free enterprises from legacy platforms

Posted in Commentary with tags on November 12, 2026 by itnerd

ServiceNow today announced Autonomous CRM Engine, a new AI-native solution built to accelerate CRM implementations for enterprises stuck in overly complicated legacy platforms. Autonomous CRM Engine helps enterprises discover how their CRM is used today, transform those business processes, and then deploy ServiceNow CRM in weeks instead of the months or even years legacy CRM implementations usually require. Once live, Autonomous CRM Engine continuously watches the environment and is designed to catch configuration drift and misconfigurations before they turn into support tickets or disrupt the business.

Nearly half of customers say they will switch to a competitor due to slow or poor service. For many enterprises, legacy CRM platforms make addressing that problem slow and expensive, and AI add-ons often leave the friction in place. Legacy CRM also limits what a business can launch, how it refines core processes, and which new capabilities it can use quickly. Typical migrations take months of manual discovery, with teams forced to reverse-engineer custom objects, workflows, validation rules, integrations, and escalation rules. Gartner® projects that, “by 2029, organizations that fail to understand current CRM system limitations will be restricted in their customer service experience improvements by 50%1.“

Across industries, traditional CRM is deeply intertwined with operational systems, regulatory requirements, and customer journeys. For example, telecom providers manage complex service activation and fulfillment workflows, financial institutions navigate compliance-heavy customer onboarding and servicing processes, and retail organizations coordinate customer-impacting store operations across fragmented systems. These realities make CRM transformation particularly difficult, all while increasing the cost of staying on legacy platforms.

ServiceNow Autonomous CRM Engine addresses these challenges directly, giving enterprises an AI-native, accurate, and fast path to:

  • Discover how customers actually use their current CRM by mapping their business processes, workflows, custom objects, and integrations, including how each is defined, configured, and connected within their own environment.
  • Design a transformed future state built on ServiceNow industry best practices, not a lift and shift of the current CRM strategy.
  • Build and deploy approved changes directly into the ServiceNow environment.
  • Monitor continuously and help catch configuration drift and misconfiguration before they become support tickets to keep the CRM current as a business evolves.

For the first time, enterprises have a real path to vendor freedom and business agility through Autonomous CRM Engine. They no longer have to choose between staying trapped in outdated systems or betting years on a risky lift and shift that replicates broken processes. After go-live, Autonomous CRM Engine helps keep the CRM current as the business changes, so customers spend less time on post-launch fixes, and the platform keeps pace with their needs. It’s designed to grow into an agentic layer that keeps the CRM running and improving over time.

Availability

Autonomous CRM Engine is in Controlled Availability today, with expanded capabilities coming in 2027.

Guest Post: NFL and AWS Introduce Next Gen Trends

Posted in Commentary with tags , on November 12, 2026 by itnerd

A first-of-its-kind interactive platform, Next Gen Trends is free to all fans, and goes beyond the box score to show the strategic identity of every team and the trends reshaping the league.

Every NFL team has a fingerprint, a play style all its own, and it shows up on every single snap. Watch a team break the huddle: the personnel grouping, the spacing of the formation, the kind of run they favor on first down. Each choice is a clue, and together they reveal an identity, sometimes one that looks nothing like the team from a few seasons ago. It is all hiding in plain sight on every play.

But a single play only shows a flash of it. What matters is the pattern it belongs to, and how those patterns connect, snap to snap, game to game, season to season. That is the real story of a team, and no broadcast or box score has ever stitched those threads together for a fan. Football has always had this layer. It has just never had a place to slow it down and show you.

Next Gen Trends changes that. It is a new, free, interactive platform on NFL.com, built on NFL Next Gen Stats (NGS), the league’s player-tracking system. But it is more than tracking data. NGS runs that raw data through more than 75 machine learning models, powered by AWS; the same ones that classify coverages, measure pressure, and identify blocking matchups to turn millions of data points into the patterns and tendencies that describe how a team actually plays. This is the engine behind the insights fans already hear on Sundays. Next Gen Trends is the first time they can dig into it themselves. Visit it here: nfl.com/trends.

Finding the Stories Beyond the Box Score

Here is what it actually does. Next Gen Trends takes eight years of NFL Next Gen Stats tracking data and reorganizes it around something the box score was never built to show – not the final numbers, but the recurring patterns that help decide games. It is built around the questions people really ask. How does my team win? What makes this matchup worth watching? How is the sport itself changing? Each answer is a visual, guided view rather than a spreadsheet, pulling the fan off the stat line and into the coach’s room where the strategy actually lives.

The goal is to take the hundreds, if not thousands, of metrics we have built across Next Gen Stats, distill them down to the few that actually represent a team’s tendencies and schemes, and present that in a way that takes a complex concept and makes it digestible. We want to get the fan at home closer to the coach’s room.

— Keegan Abdoo, Senior Manager, NFL Next Gen Stats

It works at two zoom levels. Pull back, and you see the whole league moving – schemes catching on and dying out, defenses shifting toward split-safety looks, offenses leaning more on outside zone runs – the way the sport is played drifting season over season. Zoom in, and you see a single team in sharp focus – what makes its identity distinct, how it has changed under a new coordinator, where it cuts against the grain of everyone else.

Why This Wasn’t Possible Until Now

A trends platform like this could not have existed even a few years ago. Two things changed, and together they unlocked a third that is the real reason it works.

It starts with history. Next Gen Trends draws on eight years of NFL player-tracking data, captured by chips in every player’s shoulder pads that log location many times a second. Five seasons is enough to see the game move – a scheme that was an outlier becoming the norm, a defense that reinvents itself, a leaguewide shift you could never spot one Sunday at a time. You cannot show how football is changing without seasons to compare, and this is the first time that a full arc has been laid out for fans.

Then there is automation. Figuring out what happened on a given play – the coverage, the protection, the blocking scheme – was previously done by a person watching film and charting it by hand, slowly and subjectively. Working with AWS, the Next Gen Stats team trained machine-learning models to read it straight from the tracking data, so every play in every game is described automatically, consistently, and in real time. That is what makes a leaguewide, every-snap view possible at all.

And that is what unlocks the third piece. The data does not just pile up; it becomes a story. The same models that classify a coverage or identify a run concept can connect those reads across a season into a team’s identity, surface the tendency behind a matchup, and generate the context that turns a wall of numbers into something a fan can follow. A single number says a defense blitzes 28 percent of the time. The story is that the number has climbed every week since their bye, that it spikes on third down, and that their next opponent has struggled against exactly that pressure. Same data, but now it means something. The raw data is the ingredient. The insight is the product.

We can tell the story of every element of the game now. There are games within the game: the passing offense, the run game, the pass rush, the coverage. For the first time, we can take all of that and show a fan a team’s whole identity in a single view, then let them watch how it has shifted week to week and season to season.

— Mike Band, Senior Manager, Research & Analytics, NFL Next Gen Stats

Two Ways to Explore: the League and Your Team

Next Gen Trends is built to be explored, not just read, and it opens at two altitudes a fan can move between freely. One looks out at the whole sport. The other looks hard at a single team. Each is built from the same tracking data and models, shaped into views designed to answer a different kind of question.

At the League Level

The league view is about the game as a system in motion. Instead of a standings table, it tracks how strategy itself is trending – which formations and coverages are on the rise, which are fading, and how far a given tendency sits above or below the leaguewide norm. The payoff is seeing the narrative in the movement. You can watch the league tip toward two-high safety coverage and pinpoint the season it became the default or follow the run game drift toward one blocking scheme while a handful of teams stubbornly zag the other way. It is the macro picture of how football is being played right now, and the story of how it got here over eight years.

The power is in the movement between the two. See a leaguewide trend, then drop into a single team to find out whether it follows the trend or defies it, then pull back out to see who else is doing the same thing. That back-and-forth, from the shape of the whole sport down to one snap-by-snap identity and up again, is the part no stats page or broadcast graphic has offered before.

Making the Game Easier to Understand

The hardest engineering problem on Next Gen Trends is not collecting the data or running the models. It is making the result feel simple. Anyone can dump a stat table onto a page. The real work is building visualizations that carry multiple dimensions of insight and are still immediately readable, where a fan can grasp the takeaway without having every element explained to them. As the team puts it, creating simplicity out of complexity is itself a very complex process.

Data visualization for its own sake is not the smart path. A visualization has to be valuable enough that it is digestible, that it carries more than one dimension you can take away, and that a fan understands what to take from it without a tutorial. Making something simple out of something this complex is actually the hard part.

— Keegan Abdoo, Senior Manager, NFL Next Gen Stats

In practice, that looks like representing a team’s whole identity as a radar chart or showing how a single tendency has moved year over year, or how a team’s performance shifts as its season unfolds. And the product is designed to move fluidly between the big picture and the fine detail, from the leaguewide macro view down to the granular team view and back.

The examples make it concrete. Look at how the Rams have changed across the past five seasons. Sean McVay took the league by storm with an offense that was based out of condensed formations in 11 personnel and built the run game out of outside zone. As McVay’s coaching tree spread across the league, we saw this play style permeate and defenses change in response. But the Rams have also adapted to their roster construction and changing defensive conditions and now lead the NFL in 13 personnel usage and man blocking runs. Next Gen Trends lets a fan see that entire evolution tracked over time, in one place.

Or take Kyle Shanahan and the 49ers. Many NFL football fans love Shanahan, because he evolves, and the data shows exactly what unlocked when the team added Christian McCaffrey: a twenty-one-personnel grouping that became nearly impossible to defend because the offense could run anything and everything from it, the way a positionless lineup stresses a defense in basketball. That is a story a fan can now watch unfold across the site, rather than needing a film degree to piece it together.

The Engine Under the Hood

For the fan, the story on Next Gen Trends is always football first: formations, tendencies, matchups, identity. AWS is the reason those stories can be told at this scale and this speed, but it is meant to be felt rather than announced. The models that read every play, the real-time infrastructure that describes it as it happens, and the analytics environment the research team works in day to day are all AWS, sitting underneath the handful of clean visualizations a fan actually sees.

The patterns on Next Gen Trends come from the same Next Gen Stats research the league already produces in Amazon Quick, where analysts explore tracking data, test ideas, and shape the insights that appear on air. That continuity matters. The fan experience is not a watered-down export of the real thing; it is an extension of the research workflow itself. Because the barrier to building a new view is low, an analyst can go from an idea to a published, fan-facing visualization quickly, which is what lets the platform stay fresh week to week.

The hard part is invisible to the fan, and that is the point. Running the models on every play, keeping it current through the season, serving it to millions of people at once: that all happens underneath. It frees us to focus on the football, on what is actually worth showing and how to make it land.

— Mike Band, Senior Manager, Research & Analytics, NFL Next Gen Stats

The technology story is most powerful when a fan realizes, after the fact, that what they just explored would be impossible without the analytics and infrastructure behind it. The attribution is consistent and understated by design, carried through the Next Gen Stats and AWS presence on the page rather than stamped on every chart.

A Season That Never Stops Evolving

Next Gen Trends is not a report that ships once and goes stale. It is a living platform that updates as the season moves, so that team identities, formation trends, and scheme tendencies rise and fade in something close to real time. It is built to be the kind of destination a fan checks in on every week, where the landscape has shifted a little since the last visit, and where eight seasons of history are always available underneath.

That is the real promise. The platform implicitly teaches you what matters about football right now, which strategies are working, what your team is doing and how it fits the bigger picture, by letting you explore rather than lecturing you. The more you poke at it, the more the game opens up, until a casual viewer has quietly become an informed one.

For anyone who has ever wanted to understand the chess match beneath the chaos, and maybe sound a little smarter at the Super Bowl party, the playbook is finally open. Explore Next Gen Trends on NFL.com.

The AI-First Holiday Shopping Season

Posted in Commentary with tags on November 12, 2026 by itnerd

New data from a Salesforce November 2026 Holiday Insights Survey of 500 Canadian shoppers reveals shoppers are turning to agents to help them shop, but are not yet ready to let AI spend their money.

Retailers are seeing higher conversion rates and customer loyalty with AI – but are under pressure to get their own agents right.

AI is becoming a bigger part of how the holidays get shopped

AI has become a real starting point for holiday shopping. More shoppers begin their search there, and many treat its recommendations as advice worth acting on.

  • AI is projected to drive $75.8 billion in Cyber Week spend globally, up 13% since 2025.
  • AI-driven traffic to ecommerce sites is up 12% year over year globally, and AI-driven recommendations are projected to influence over 1 in 5 holiday orders.
    • Gemini has moved into the top AI search spot with 50% of AI search visits, overtaking ChatGPT at 43%. A year ago, Gemini had just 8% of AI search visits and ChatGPT had 81%.
  • 16% of Canadian shoppers turn to AI as the first stop in their shopping journey.
  • 75% of Canadian shoppers trust the recommendations they receive from AI.
  • AI’s advice carries weight: 18% of Canadian AI shoppers say these tools frequently introduce them to new brands. And almost 1 in 10 (9%) of shoppers say they wouldn’t buy something if an AI assistant told them not to.

Personal agents are catching on, but shoppers aren’t handing over their wallets yet

Shoppers are quickly adopting personal AI agents to compare products and check reviews – but for now, these agents are treated as researchers rather than buyers.

  • 28% of Canadian consumers have tried a personal AI agent.
    • Meta Muse is the most widely adopted personal agent, used by 12% of consumers today. It’s also the most recognized, followed by Grok Bot.
  • 22% of Canadian personal agent users assign their agent tasks multiple times a day.
  • Shoppers turn to personal agents for 1) price comparison, followed by 2) analyzing product specifications and reviews.
  • 5% of Canadian consumers have already let a personal AI agent make a purchase for them.
  • Just 9% of Canadian personal agent users give their agents unrestricted access to their financial details. 34% of personal AI agent users have set up a separate credit card just for their agent to use.
  • 53% of Canadian shoppers are not interested in having a personal AI agent make purchases for them. Top obstacles holding consumers back from using AI agents are:
    • Unwanted sharing of purchase history or personal data
    • Accidental or unwanted charges

Agents pay off for retailers, but shoppers won’t forgive many mistakes

Retailers that offer their own shopper agents are seeing bigger orders and stronger loyalty – but shoppers have little patience for AI that gets things wrong.

  • 33% of Canadian shoppers have used a brand shopper agent on an ecommerce site. 83% reported a good experience, and 63% of that group felt more loyal to the brand afterward.
  • Most Canadian shoppers will abandon an AI assistant after just 2-3 mistakes. When AI makes a bad recommendation, 32% of shoppers blame the AI agent.
  • Among Canadian personal AI agent users, 22% say their agent has bought an item that was too expensive. 20% have had their agent blocked from making a purchase, and only 36% report no major errors at all when shopping with an agent.

What the Canadian data tells us about holiday shopping with AI

  • Canadians are the least keen on agents shopping for them. 53% are not interested in an agent browsing or buying on their behalf, the highest of the four larger markets (US 49%, UK 50%, Australia 42%). 5% have already let an agent make a purchase (US 12%), and 13% of Canadian agent users let their agent check out (US 21%, Australia 22%).
  • Canada looks more like the US than its peers on agent awareness. 47% of Canadians know Meta Muse, close to the US (51%) and well ahead of Australia (28%) and the UK (23%) where the service is not available yet. 12% use it, the same share as in the US.
  • AI rarely surprises Canadians with a new brand. Only 18% of Canadian AI shoppers say general AI assistants frequently introduce them to new brands, the lowest of the seven countries surveyed (Australia 42%, US 31%, UK 25%). 58% say it happens occasionally.
  • Social shopping is still in its infancy in Canada. 21% bought through social media in the past three months, against 35% in the US, UK and Australia, and 9% expect to shop on social platforms this holiday season (US 22%). 75% expect to shop in physical stores, the highest of the four larger markets (US 68%, UK 68%, Australia 70%).

Source: Salesforce November 2026 Holiday Insights Survey, Canada (n=500). Questions about AI assistants and personal agents were asked of subsets of respondents. Comparisons with the US, UK and Australia are from the same survey.

1 in 3 incident response leaders let AI triage alerts autonomously

Posted in Commentary with tags on November 12, 2026 by itnerd

New research from Securonix finds that incident response leaders are moving faster than their peers to automate security decisions, even as they encounter challenges putting AI to work.

In a survey of 1,000 cybersecurity professionals across the U.S., U.K., France and Australia, Heads of Incident Response reported:

  • 33% use fully autonomous AI for alert triage and analysis, compared with 19% overall.
  • 56% cite faster mean time to resolve as an AI success measure, compared with 33% overall.
  • 36% report technology issues during implementation, compared with 27% overall.

The findings raise questions about how quickly security teams are handing decisions to AI and whether their systems are ready to support that autonomy.

Read the full report here.

Samsung’s 5 best Black Friday deals that are already here

Posted in Commentary with tags on November 12, 2026 by itnerd

Black Friday is all about getting ahead on holiday shopping. But why wait until then to get a head start?

Samsung Canada’s Black Friday deals are already live, with savings across Galaxy smartphones, watches, earbuds and tablets. From enhanced trade-in offers to device bundles, Canadians can put a dent in their holiday shopping lists well before November 27th.

A few deals worth checking out:

  • Galaxy Z Fold series: Save up to $1,500 when trading in an eligible device (including up to a $500 trade-in bonus). Ideal for those who want a smartphone with a larger screen for multitasking and streaming, but without sacrificing portability.
  • Galaxy S26 Ultra: Save up to $1,290 when trading in an eligible device (including up to a $450 trade-in bonus). A powerful pick for photography enthusiasts, with advanced camera capabilities and Galaxy AI.
  • Galaxy Z Fold8 Ultra + Galaxy Watch9 (44mm): Get both for $2,668.99 (regularly $3,259.98), saving $590.99. Pair the Z Fold8 Ultra’s top-notch battery and camera performance with a smartwatch that keeps key insights within reach.
  • Galaxy Z Fold8 + Galaxy Buds4 Pro: Get both for $2,199.99 (regularly $2,729.98), saving $529.99. A great combo for consuming content on a larger screen with premium earbuds to match.

Samsung is also offering $200 off the Galaxy Tab S10 FE+, but only through November 18th, giving shoppers even more reason to get ahead of Black Friday.

These are just a few of Samsung Canada’s 15 seasonal offers. Explore the full lineup on Samsung Canada’s Black Friday page.

And for a little extra peace of mind this gifting season, shoppers can add Samsung Care+ to eligible Galaxy devices, with flexible protection available in month-to-month, 12-month or 24-month plans.

Specops Introduces Identity Verification for AI Chatbots to Help Prevent Impersonation Attacks

Posted in Commentary with tags on November 12, 2026 by itnerd

Specops, an Outpost24 company, today announced the launch of the Specops Authentication API, enabling organizations to integrate secure identity verification directly into AI chatbots, applications and automated business workflows. As businesses increasingly use AI to handle sensitive requests, the API helps organizations verify users before automated processes proceed.

The risks are already evident. In June 2026, Meta disclosed that attackers had exploited a verification flaw in its AI-assisted Instagram account recovery system to obtain password reset links for accounts they did not own, potentially affecting 20,225 accounts. The incident highlights the importance of robust identity verification before automated systems carry out sensitive requests.

The Specops Authentication API addresses this challenge by allowing organizations to embed identity checks directly into their existing workflows. For example, when an employee asks an internal AI chatbot to initiate a password reset, the chatbot can trigger a verification request using an authentication method the employee is already enrolled in. The API returns the result, allowing the organization’s workflow to determine whether to proceed, reject the request or escalate it for further review. For password reset requests, the API can also reset passwords or unlock accounts after successful verification.

Unlike solutions that require users to adopt additional authentication tools, the Specops Authentication API uses methods already configured for the employee, without requiring a new application or re-enrollment. While the API requires a Microsoft Active Directory environment to manage user enrollments, it is platform-agnostic when it comes to integration, allowing organizations to build verification into their preferred chatbot, IT service management platform or other business applications. Organizations retain control over when verification is required and what happens next, with verification events logged to support auditing and accountability.

Beyond AI chatbots, organizations can integrate verification into IT service management tools such as ServiceNow, employee onboarding processes and other workflows requiring identity confirmation. It can also enable employees to verify one another’s identities, helping protect against impersonation attempts.

Specops provides the API, technical documentation and underlying verification services, while organizations build integrations tailored to their own systems and security requirements.

4 in 10 younger Canadians would let AI handle their holiday shopping

Posted in Commentary with tags on November 12, 2026 by itnerd

Would you let AI shop for everyone on your holiday list?

For younger Canadians, the answer is increasingly yes. New Mastercard research shows that shoppers are turning to AI to find the right gifts, stretch their budgets and simplify holiday shopping.

But as AI moves from recommending products to making purchases on consumers’ behalf, questions around trust, security and control become increasingly important, particularly when money, loyalty points and transactions are involved.

Mastercard’s latest Shopper Snapshot, conducted with The Harris Poll, explores how comfortable Canadians are with AI taking on a bigger role in their holiday shopping and where they still want to call the shots.

A few key findings:

  • 43% of Canadian Gen Z and 44% of millennials say AI knows them well enough that they trust it to pick gifts for loved ones more than they trust themselves, versus just over a quarter (26%) of shoppers overall.
  • 38% of Canadian Gen Z and 43% of millennials would let AI handle all of their gift buying if it meant avoiding the stress.
  • Canadian consumers want AI to help them shop smarter, not just cheaper: 62% want an AI agent to weigh quality, trust and personal preferences alongside price, while 26% say AI has already increased their ability to stay within budget.
  • When considering the use of AI shopping agents, 67% of Canadians surveyed want to approve a transaction before an agent uses their loyalty points or benefits.

You can read more HERE.

Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails

Posted in Commentary with tags on November 12, 2026 by itnerd

ESET researchers have discovered a new toolset, which we have named Cereal. The toolset features a novel Exchange email collection module, a unique command and control (C&C) mechanism, and sophisticated .NET execution tricks. Designed to run on Microsoft Exchange servers, it receives commands, executes them in memory, maps the compromised organization, and collects selected email messages. ESET identified two victims – a governmental organization in Kazakhstan and a governmental organization in Romania – where Cereal was configured to identify emails sent to, or received from, NATO and the EU. ESET Research attributes Cereal, with high confidence, to the Russia-aligned APT group Turla.

The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.

ESET identified two national governmental organizations compromised by Cereal late in 2025 and located in geographies that align closely with Turla’s known targeting. Based on ESET telemetry, around 70% of countries targeted by Turla since 2022 have been former Soviet republics or European countries that were once closely aligned with the Soviet Union. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be part of Russia’s Federal Security Service (FSB).

The Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses. This focus fits long-standing Russian intelligence priorities. It may also relate to regional tensions: since early 2025, Romania has reported several incidents involving Russian drones crashing near or within its territory, prompting strong reactions from Romanian authorities and calls for a NATO mission in the Black Sea region. The Kazakh compromise also occurred in a relevant political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had previously found relative safety there after Russia’s full-scale invasion of Ukraine.

Reconstructing the attack chain revealed a modular toolset built around a few recurring design principles: keep payloads encrypted, keep execution in memory whenever possible, reuse the compromised Exchange server, and deliver commands as separate .NET assemblies. One of the most interesting aspects of this toolset is what ESET did not find: external C&C infrastructure. Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.
The use of various .NET tricks, such as unmanaged entry points, and abuse of the .NET native image cache make this toolset quite sophisticated in comparison to most recent APT cases that ESET has researched.

For more technical details about Turla’s latest toolset, check out the ESET Research blogpost and white paper “Exchange for breakfast: Turla’s Cereal tricks are not for kids,” on WeLiveSecurity.com