Russian Hackers Hijack Exchange Servers to Spy on NATO, EU

Russian state- group Turla turned Microsoft Exchange email servers into attacker-controlled infrastructure for spying on messages involving the North Atlantic Treaty Organization and European Union, researchers found.

See Also: OnDemand | How Okta and CrowdStrike Signals to Enforce Protection Against Cross-Domain Attacks

Security firm Eset, with high confidence, attributes the Exchange email collection module to the group aligned with Russia's Federal Security Service. The campaign shared a malware component with toolset publicly linked to Turla, as well as conceptual similarities with the group's older artifact, Eset said.

The previously undocumented toolset, dubbed Cereal, is "a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map the compromised organization, and collect selected email messages," Eset said.

"What makes this toolset stand out is its combination of novel techniques requiring deep knowledge of Exchange internals with unusual .NET execution methods," it said. "The Cereal toolkit demonstrates Turla's ability to carry out a slow, careful, long-term intrusion built around Microsoft Exchange servers."

In late 2025, researchers found Cereal in a governmental organization in Kazakhstan, where it silently monitored outgoing emails and copied messages of interest to forward to attackers. A month later, targeted detection efforts uncovered the same toolset in the Romanian government, configured to forward emails sent to or received from NATO and the EU.

The information collected matches Russian intelligence priorities. Since 2022, 70% of the group's targets have been former Soviet republics or European countries once closely aligned with the Soviet Union, Eset said.

The cyberespionage campaign in Romania may also reflect heightened regional tensions, Eset said, after the country called for a stronger NATO presence in response to Russian drones crossing into its territory, crashing and injuring civilians amid Russia's war in Ukraine.

Kazakhstan has also reportedly begun deporting Russian dissidents who previously sought asylum in the country, including a former volunteer for opposition leader Alexei Navalny. Eset said Russian authorities could be trying to gain intelligence those exiles.

Rather than a classic backdoor, the group infected email servers with a chain of components: "encrypted payloads on disk, .NET assemblies embedded inside other .NET assemblies, legitimate Windows processes loading suspicious DLLs, and Exchange services executing code that did not belong there," Eset said.

What researchers didn't find was external command-and-control infrastructure. "Instead - adding insult to injury - the victim's compromised Exchange server is co-opted to act as the C&C infrastructure," Eset said.

The main backdoor resides on compromised Exchange servers, waiting for incoming web requests that look like ordinary traffic. This means there is no dedicated attacker infrastructure to take down, and operator IP addresses are not easily identifiable through network-based tracking, Eset said. Malicious traffic coexists with legitimate services and only gets decrypted if it is properly encrypted and passes several integrity checks.

"Abusing a compromised Exchange server as a central operational hub is a rare technique, used by only a handful of APT groups. Turla has used variations of this approach in the past," Eset said.

Turla has targeted Microsoft Exchange servers since at least 2014, using its LightNeuron backdoor to execute commands hidden in PDF or JPEG email attachments.