Researchers at cybersecurity company ESET documented the attacks in late 2025, initially finding modular .NET malware for Microsoft Exchange at a government body in Kazakhstan. A month later, ESET found the same toolset at a government agency in Romania, where it selectively gathered email correspondence with representatives of the North Atlantic Treaty Organization (NATO) and the European Union (EU). "After fine-tuning our detections, we found the same toolset at a governmental organization in Romania - compromised on December 23rd, 2025," the researchers say in a report today. Turla, also known as Snake, Secret Blizzard, and Waterbug, is a cyber-espionage group active for more than two decades and linked to Russia's Federal Security Service (FSB).
security —
Turla hackers use new Cereal malware to spy on govt Exchange servers
The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations.
Reported by bleepingcomputer.com, helpnetsecurity.com and thehackernews.com.
