Turla Cereal toolset targets government Exchange servers

On 10 November 2026, ESET said Russia-linked Turla used a new modular .NET toolset called Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. The malware used the victims' own Exchange servers as command and control infrastructure and disguised traffic as ordinary Outlook Web Access, Autodiscover, and ActiveSync. In Romania, it was configured to collect emails sent to or received from NATO and EU addresses.

On 12 November 2026, Romania's intelligence agency said it stopped a cyberattack by Russian state-linked hackers on a government institution, detected in December 2025. The operation was attributed to Turla, linked to Moscow's FSB, which exploited vulnerabilities in Microsoft systems. ESET said the group used a previously unknown toolkit called Cereal to monitor email traffic and maintain access to Microsoft Exchange servers, with no sensitive data exfiltrated.