Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan using a previously undocumented malware toolkit designed for covert surveillance. The operation allowed attackers to intercept selected communications, including messages exchanged with NATO and European Union institutions, without interrupting normal email delivery.
Cybersecurity company ESET disclosed the findings on November 10, 2026, attributing the activity with high confidence to Turla, a long-running cyberespionage group associated with Russia’s Federal Security Service (FSB). The researchers named the newly discovered toolkit Cereal.
The first known infection was identified at a government organization in Kazakhstan on November 28, 2025. Further investigation uncovered the same malware at a Romanian government institution, where researchers traced the compromise to December 23, 2025.
In Romania, the attackers configured their tools to identify emails involving NATO and EU addresses, including nato.int and europa.eu. The targeted collection suggests that the operation focused on obtaining government and diplomatic intelligence rather than stealing large volumes of unrelated information.
Cereal operates directly inside compromised Microsoft Exchange servers. One of its components, CerealBox, integrates with the software responsible for processing incoming and outgoing emails, allowing attackers to examine messages before they reach their destinations.
The malware selects communications based on predefined criteria, including sender and recipient addresses, email subjects, and attachment names. It can also identify messages containing Word documents and PDF attachments. Matching emails are copied, compressed, and encrypted for later retrieval.
Importantly, the original messages continue through the normal delivery process. This allows the attackers to collect information without creating obvious disruptions that might alert employees or system administrators.
Another component, CerealNeuron, provides remote access to compromised servers. Instead of communicating with a conventional external command server, it waits for specially constructed requests sent directly to the victim’s Exchange infrastructure.
These requests resemble legitimate Microsoft Exchange web services, making malicious activity more difficult to distinguish from ordinary network traffic. Additional components allow the attackers to execute programs in memory, examine internal systems, and collect information about the compromised environment.
ESET noted that the toolkit was designed to leave relatively few recognizable files on disk. Its use of encrypted components and legitimate server processes complicates forensic analysis and traditional malware detection.
Turla has conducted cyberespionage operations for more than two decades, frequently targeting government agencies, diplomatic organizations, and other institutions holding politically sensitive information. The group’s previous campaigns have involved multiple malware families and techniques for maintaining long-term access to compromised networks.
Researchers have not determined how the attackers initially entered either government organization. Although the affected Exchange servers were accessible from the internet, there is no confirmed evidence that a specific software vulnerability was exploited.
The amount of information obtained during the campaign also remains unknown. ESET identified two compromised organizations but did not establish whether additional victims were affected by the same toolkit.