ESET: Turla hides new Cereal toolset on government Exchange servers to collect NATO and EU correspondence

ESET said on November 10 that it found a previously undocumented modular .NET espionage toolset, Cereal, on Microsoft Exchange servers at one government body each in Kazakhstan and Romania, and attributed it with high confidence to the Russia-aligned APT group Turla ^[1]. ESET says the Romanian organization was compromised on December 23, 2025, that the tools were configured to identify emails exchanged with NATO and the EU, and that no external command-and-control was used: the victim Exchange server itself served as the control point ^[1][2]. Exchange administrators should check ESET's indicators of compromise published on GitHub for Cereal components on their servers ^[2].

Industries mainly affected: Government

ESET says the Romanian organization was compromised on December 23, 2025, that the tools were configured to identify emails exchanged with NATO and the EU, and that no external command-and-control was used: the victim Exchange server itself served as the control point ^[1]