Russia-aligned espionage group Turla used a previously undocumented toolset to turn compromised Microsoft Exchange servers into covert email-collection and command hubs, according to research published Tuesday by ESET Research [1]. ESET found the malware, dubbed Cereal, at government organizations in Kazakhstan and Romania, with the Romanian deployment configured to identify correspondence sent to or received from NATO and European Union institutions.
The findings do not indicate that NATO or EU networks themselves were breached. Instead, Turla compromised the Exchange environments of two national government organizations and used those systems to inspect mail as it moved through the transport pipeline. ESET said the Romanian case was discovered roughly a month after the toolset was first identified at a Kazakh government victim in late 2025.
Cereal includes a component called CerealBox, which was injected into the legitimate EdgeTransport.exe process and manipulated Exchange transport handlers. It could filter messages using sender, recipient, subject and attachment criteria, including documents in formats such as .doc, .docx and .pdf. Selected messages were compressed, encrypted and staged for later collection while the original mail continued through the server.
The campaign’s stealth came partly from its dependence on the victim’s own infrastructure. ESET observed no external command-and-control infrastructure; instead, the compromised Exchange server received commands, executed .NET assemblies in memory and helped map the internal network. The researchers said the toolset also abused .NET native-image caching and unmanaged entry points, techniques intended to reduce files written to disk and make forensic discovery more difficult.
ESET attributes Cereal to Turla with high confidence, linking the activity to the Russia-aligned group also known as Snake and Uroburos. The company says Turla is widely assessed to be associated with Russia’s Federal Security Service. The targeting of government mail involving NATO and the EU is consistent with the group’s established focus on political and strategic intelligence, but the research does not establish that the targeted institutions’ own systems were compromised.
The ESET report does not identify a CVE, a specific vulnerable Exchange version or a public proof of concept, and it does not say that Cereal exploited a newly disclosed Exchange flaw. It also does not publish a patch that would remove the malware. Organizations running Exchange should therefore treat unexplained transport-agent changes, unauthorized modifications to EdgeTransport.exe, suspicious .NET assemblies and unusual mail-staging files as possible intrusion indicators, investigate server integrity and credentials, and apply Microsoft’s current security updates while using ESET’s technical report for detection details.
