Turla Group Uses Cereal Malware to Spy on Government Email Servers

• •Turla's Cereal malware targets Microsoft Exchange servers in Kazakhstan and Romania.
• •The malware intercepts emails, particularly those involving NATO and EU communications.
• •Cereal operates without external command-and-control infrastructure, using compromised servers for operations.

The Russian state-aligned group Turla has deployed a new malware toolkit named Cereal to compromise Microsoft Exchange servers at government organizations in Kazakhstan and Romania. This sophisticated toolset, discovered by ESET, allows attackers to intercept and collect emails, particularly those involving NATO and EU communications. The malware operates without external command-and-control infrastructure, instead using the compromised servers to execute commands and gather intelligence. ESET first identified Cereal in a Kazakh government agency on November 28, 2025, and later in Romania on December 23, 2025. The Cereal toolkit is modular, utilizing components like CerealBox and CerealNeuron to hijack email transport processes and selectively capture messages based on predefined criteria. The attacks reflect ongoing geopolitical tensions, particularly in the context of Russia's actions in Ukraine and its relations with NATO. ESET attributes the toolset to Turla with high confidence due to its technical similarities to previously documented malware associated with the group.