Adversary Intelligence — 2026-11-12

ESET Reveals FSB-Linked Turla Group Compromised Romanian Government Exchange Server to Harvest NATO and EU Emails

BLUFTurla's use of victims' own Exchange servers as command channels renders standard network-perimeter defenses ineffective, leaving other Eastern European and Central Asian government mail systems at risk of similar undetected collection.

Slovak firm ESET reported on November 10 that Turla, a group it and press accounts link to Russia's FSB, planted a previously undocumented modular .NET toolset called Cereal on Microsoft Exchange servers at government bodies in Kazakhstan and Romania 123. ESET first found it in Kazakhstan in November 2025 and on a Romanian government organization's server, compromised December 23, 2025 13. In Romania, the CerealBox component was configured to copy emails with NATO and EU institutions, selecting messages with Word or PDF attachments by sender, recipient and subject filters 13. ESET observed no external command-and-control infrastructure, as operators sent commands through the victim's own Exchange server disguised as Outlook Web Access, Autodiscover and ActiveSync traffic 34. The Record reported that ESET could not determine the initial access method or how much data was taken 2.

Analysis
Turla has turned two governments' Exchange servers into self-contained collection platforms, so perimeter blocking cannot safeguard NATO and EU correspondence. Cereal routes commands through the victim's own server as Outlook Web Access, Autodiscover and ActiveSync traffic, leaving no external command-and-control address to blacklist. The Romanian filters on NATO and EU senders, recipients and subjects with Word or PDF attachments point to a requirement for alliance policy documents rather than bulk mail theft, though they may instead be opportunistic keyword collection serving a broad intelligence requirement. Because the initial access method and data volume are unknown, other Exchange operators in Eastern Europe and Central Asia cannot yet assess their own exposure. Confidence is moderate, resting on a single ESET report relayed by four outlets, with no independent technical confirmation and no victim statement.

4 sources

Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU - C4ISRNet
Russian hackers compromised government email servers to steal NATO, EU correspondence - The Record (Recorded Future News)
Turla hackers use new Cereal malware to spy on govt Exchange servers - BleepingComputer
Turla’s Cereal malware turns victims’ Exchange servers into spy hubs - Help Net Security