Adversary Intelligence — 2026-11-13

FSB-Linked APT Turla Deployed Cereal Toolset on Government Exchange Servers in Kazakhstan and Romania

BLUFIt is unlikely that vendors or agencies will publicly attribute a new government Exchange intrusion to Turla's Cereal toolset beyond Kazakhstan and Romania within 90 days, as its lack of external infrastructure limits independent discovery.

ESET Research reported on November 10 that it found a previously undocumented toolset, Cereal, on Microsoft Exchange servers at government bodies in Kazakhstan and Romania, and attributes it to Turla with high confidence 1. Security Affairs, relaying the ESET analysis, reported the Kazakh discovery on November 28, 2025 and the Romanian compromise on December 23, with the Romanian instance configured to flag email to or from NATO and the EU 2. ESET found no external command-and-control server; the CerealNeuron backdoor runs on the victim's Exchange server and takes commands through paths mimicking Outlook Web Access, Autodiscover and ActiveSync traffic 12. Per Security Affairs, the CerealBox module injects into EdgeTransport.exe, stages selected .doc, .docx and .pdf messages on disk, and operators later collect them 2. ESET describes Turla as assessed to be part of Russia's FSB 1.

Analysis
Confidence is low: all coverage traces to one ESET research stream, and no second vendor or agency confirms Cereal telemetry. It is unlikely that security vendors or government agencies will publicly attribute a new government-owned Exchange intrusion to Turla's Cereal toolset, beyond Kazakhstan and Romania, between November 14 and mid-February. Cereal leaves little on disk and uses no external command server, so blocklists and firewall logs will not reveal other victims, and a clean transport agent list proves nothing. Detection depends on host checks of the Windows management folder, the .NET native image cache, and Outlook Web Access, Autodiscover and ActiveSync requests. Neither state has acknowledged the compromise, and no CERT has issued an advisory since November 10. Turla may already hold Cereal in networks ESET never reached, so two victims could understate the footprint. If further victims are attributed, Exchange operators in European and former Soviet government networks must begin host-level hunts and treat mail servers as collection points.

3 sources