Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails
ESET researchers have discovered a new toolset, which we have named Cereal. The toolset features a novel Exchange email collection module, a unique command and control (C&C) mechanism, and sophisticated .NET execution tricks. Designed to run on Microsoft Exchange servers, it receives commands, executes them in memory, maps the compromised organization, and collects selected email messages. ESET identified two victims – a governmental organization in Kazakhstan and a governmental organization in Romania – where Cereal was configured to identify emails sent to, or received from, NATO and the EU. ESET Research attributes Cereal, with high confidence, to the Russia-aligned APT group Turla.
The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.
ESET identified two national governmental organizations compromised by Cereal late in 2025 and located in geographies that align closely with Turla’s known targeting. Based on ESET telemetry, around 70% of countries targeted by Turla since 2022 have been former Soviet republics or European countries that were once closely aligned with the Soviet Union. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be part of Russia’s Federal Security Service (FSB).
The Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses. This focus fits long-standing Russian intelligence priorities. It may also relate to regional tensions: since early 2025, Romania has reported several incidents involving Russian drones crashing near or within its territory, prompting strong reactions from Romanian authorities and calls for a NATO mission in the Black Sea region. The Kazakh compromise also occurred in a relevant political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had previously found relative safety there after Russia’s full-scale invasion of Ukraine.
Reconstructing the attack chain revealed a modular toolset built around a few recurring design principles: keep payloads encrypted, keep execution in memory whenever possible, reuse the compromised Exchange server, and deliver commands as separate .NET assemblies. One of the most interesting aspects of this toolset is what ESET did not find: external C&C infrastructure. Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure. The use of various .NET tricks, such as unmanaged entry points, and abuse of the .NET native image cache make this toolset quite sophisticated in comparison to most recent APT cases that ESET has researched.
This entry was posted on November 12, 2026 at 8:14 am and is filed under Commentary with tags ESET. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails
ESET researchers have discovered a new toolset, which we have named Cereal. The toolset features a novel Exchange email collection module, a unique command and control (C&C) mechanism, and sophisticated .NET execution tricks. Designed to run on Microsoft Exchange servers, it receives commands, executes them in memory, maps the compromised organization, and collects selected email messages. ESET identified two victims – a governmental organization in Kazakhstan and a governmental organization in Romania – where Cereal was configured to identify emails sent to, or received from, NATO and the EU. ESET Research attributes Cereal, with high confidence, to the Russia-aligned APT group Turla.
The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.
ESET identified two national governmental organizations compromised by Cereal late in 2025 and located in geographies that align closely with Turla’s known targeting. Based on ESET telemetry, around 70% of countries targeted by Turla since 2022 have been former Soviet republics or European countries that were once closely aligned with the Soviet Union. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be part of Russia’s Federal Security Service (FSB).
The Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses. This focus fits long-standing Russian intelligence priorities. It may also relate to regional tensions: since early 2025, Romania has reported several incidents involving Russian drones crashing near or within its territory, prompting strong reactions from Romanian authorities and calls for a NATO mission in the Black Sea region. The Kazakh compromise also occurred in a relevant political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had previously found relative safety there after Russia’s full-scale invasion of Ukraine.
Reconstructing the attack chain revealed a modular toolset built around a few recurring design principles: keep payloads encrypted, keep execution in memory whenever possible, reuse the compromised Exchange server, and deliver commands as separate .NET assemblies. One of the most interesting aspects of this toolset is what ESET did not find: external C&C infrastructure. Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.
The use of various .NET tricks, such as unmanaged entry points, and abuse of the .NET native image cache make this toolset quite sophisticated in comparison to most recent APT cases that ESET has researched.
For more technical details about Turla’s latest toolset, check out the ESET Research blogpost and white paper “Exchange for breakfast: Turla’s Cereal tricks are not for kids,” on WeLiveSecurity.com
Share this:
Like this:
Related
This entry was posted on November 12, 2026 at 8:14 am and is filed under Commentary with tags ESET. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.