Turla Cereal Malware Targets Government Exchange Servers in NATO and EU Espionage Campaign

Cybersecurity researchers at ESET have uncovered a previously undocumented espionage toolkit called Cereal, which they attribute with high confidence to the Russia-aligned Turla threat group. The malware targets compromised Microsoft Exchange servers and can collect selected emails, execute commands in memory and map an organisation's internal network.

ESET identified the toolkit at two government organisations, one in Kazakhstan and another in Romania. In the Romanian case, the attackers configured the malware to identify messages sent to or received from NATO and European Union addresses. The findings, published on November 10, reveal how attackers can exploit trusted enterprise email infrastructure to conduct long-term intelligence gathering.

Turla Cereal malware exploits Microsoft Exchange

The Cereal toolkit is a modular collection of malicious .NET components designed to operate inside compromised Exchange environments. Rather than disrupting normal email delivery, it can inspect messages as they pass through the server and quietly copy those that match specific collection criteria.

One component, CerealBox, is injected into Microsoft's EdgeTransport.exe process, which handles email transport. It interferes with the processing of existing transport agents in memory, allowing it to examine selected messages without registering a new transport agent.

ESET found that the collection module could select emails based on sender, recipient, subject and attachment-name criteria. In the Romanian environment, it was configured to identify correspondence involving NATO and EU addresses. The malware could also prioritise messages containing document attachments, including DOC, DOCX and PDF files.

Compromised Exchange servers become command centres

Another component, CerealNeuron, acts as a passive backdoor on the compromised server. It listens for specially crafted, encrypted web requests sent through paths resembling legitimate Microsoft Exchange services. Once a request passes its checks, the toolkit can execute supplied commands in memory.

Those commands can support activities such as retrieving emails, querying Active Directory for information about users and groups, extracting locally stored credentials and accessing files.

A particularly unusual feature is the toolkit's command-and-control arrangement. ESET found no external command-and-control infrastructure in the investigated cases. Instead, the attackers used the compromised Exchange server itself as their operational hub.

This approach reduces the need for separate attacker-controlled servers that defenders might identify through network monitoring. It also allows malicious activity to blend into traffic associated with legitimate email services.

ESET links the toolkit to Russia-aligned Turla

ESET first discovered the toolkit at a government organisation in Kazakhstan on November 28, 2025. Researchers later identified the same toolset at a Romanian government organisation, which had been compromised on December 23, 2025.

The security company attributes Cereal to Turla with high confidence, citing the concurrent use of another component publicly linked to the group and similarities with older Turla malware. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be associated with Russia's Federal Security Service.

ESET has not established how the attackers initially gained access to the two Exchange environments. It also has not disclosed the full amount of information collected during the operations.

Why the discovery matters for enterprise security

The Turla Cereal malware findings highlight a difficult challenge for organisations running Microsoft Exchange. An attacker who compromises the server responsible for handling email can potentially monitor sensitive communications from within the normal delivery process.

The absence of visible external command infrastructure and the use of legitimate Exchange processes make conventional detection more difficult. Government agencies, diplomatic organisations and businesses handling sensitive communications therefore need to monitor server behaviour, investigate unexpected changes to Exchange processes and review unusual access to internal directory information.

ESET has published technical research and indicators of compromise to help security teams investigate potential exposure. The findings show how sophisticated espionage groups can turn trusted enterprise systems into surveillance tools without necessarily interrupting the services employees rely on every day.