Slovak cybersecurity firm ESET attributed the campaign to Turla, a long-running Russian espionage group linked to the country's Federal Security Service (FSB). The hackers used a previously unknown toolkit dubbed Cereal to monitor email traffic, steal specific messages and maintain access to compromised Microsoft Exchange servers without being detected.
“The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes,” ESET said.
The researchers said they first discovered the toolkit in November 2025 on a government email server in Kazakhstan and later identified it at a Romanian government organization. In Romania, the malware was configured to collect emails exchanged with NATO and EU institutions.
