Adversary Intelligence — 2026-11-15

Russian FSB Hackers Target NATO and EU Emails Exploiting Microsoft Flaws

BLUFTurla's use of victim Exchange servers as silent command infrastructure means NATO members relying on perimeter monitoring alone have no assurance their own diplomatic mail has not already been siphoned undetected.

ESET, which publicly disclosed the operation on November 10, attributed a previously undocumented .NET toolset it named Cereal to Turla, a group generally considered affiliated with Russia's FSB, with high confidence 1. Cybernews reported that Turla compromised Romanian government Microsoft Exchange servers, and Commondef put the breach at December 23, 2025, about a month after ESET first found the tool on a Kazakh government server 12. Per Commondef, the CerealBox component filtered for NATO and EU addresses, selected emails with Word or PDF attachments, then compressed and encrypted copies for later retrieval 1. Cybernews, citing ESET, said the victim's own Exchange server served as the command hub in place of external infrastructure, and that how the attackers gained initial access and how much data they took remain unknown 2.

Analysis
Turla's Cereal toolset shows that Exchange servers holding NATO and EU correspondence can leak for months with no external command traffic for defenders to block. Allied governments running on-premises Exchange must audit transport agents and in-memory .NET modules, since perimeter monitoring would have caught nothing. The Romanian compromise dates to December 23, 2025, so exposure ran about ten months before disclosure. The unknown initial access route and unmeasured volume of stolen mail leave other NATO members unable to size their own exposure. Confidence is low: ESET is the sole primary source, secondary outlets only repeat its findings, and no victim has independently confirmed. The Romanian and Kazakh servers may also be opportunistic footholds, with the NATO and EU filters reflecting broad collection tasking rather than a campaign aimed at alliance communications.

4 sources

Russian FSB Hackers Breach Romanian Servers, Siphon NATO and EU Emails - Commondef
Russian hackers breach Romania emails with new malware - Cybernews
Russian FSB targets NATO emails as hackers exploit Microsoft flaws - Defence24
Exchange for breakfast: Turla's Cereal tricks are not for kids - ESET Research (WeLiveSecurity)