ESET Research: Russia-aligned Turla group uses novel Exchange tool to spy on EU, NATO emails

• ESET Research has uncovered a sophisticated, modular, tightly interconnected toolset, designed to run on Exchange servers of compromised entities for long-term cyberespionage.
• The Russia-aligned Turla APT group is behind the toolset; Turla is assessed to be part of Russia’s FSB.
• ESET observed the novel Exchange tool at a governmental organization in Kazakhstan and a compromised governmental organization in Romania, collecting emails to NATO and the EU.
• No external network infrastructure was observed. One of the malicious components, a passive backdoor that runs on Exchange servers, provides access to the internal network.
• An automated email collection module, injected into legitimate Microsoft Exchange processes, accesses and manipulates the email transport pipeline.
  
  

BRATISLAVA, Slovakia and MONTREAL, Nov. 10, 2026 (GLOBE NEWSWIRE) -- ESET researchers have discovered a new toolset, which we have named Cereal. The toolset features a novel Exchange email collection module, a unique command and control (C&C) mechanism, and sophisticated .NET execution tricks. Designed to run on Microsoft Exchange servers, it receives commands, executes them in memory, maps the compromised organization, and collects selected email messages. ESET identified two victims – a governmental organization in Kazakhstan and a governmental organization in Romania – where Cereal was configured to identify emails sent to, or received from, NATO and the EU. ESET Research attributes Cereal, with high confidence, to the Russia-aligned APT group Turla.

The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.

ESET identified two national governmental organizations compromised by Cereal late in 2025 and located in geographies that align closely with Turla’s known targeting. Based on ESET telemetry, around 70% of countries targeted by Turla since 2022 have been former Soviet republics or European countries that were once closely aligned with the Soviet Union. Turla, also known as Snake, has been active since at least 2004 and is widely assessed to be part of Russia’s Federal Security Service (FSB).

The Romanian case is notable because one component, CerealBox, was configured to collect messages involving NATO and EU institutional addresses. This focus fits long-standing Russian intelligence priorities. It may also relate to regional tensions: since early 2025, Romania has reported several incidents involving Russian drones crashing near or within its territory, prompting strong reactions from Romanian authorities and calls for a NATO mission in the Black Sea region. The Kazakh compromise also occurred in a relevant political context. Since January 2026, Kazakhstan has reportedly begun deporting some Russian exiles and regime critics who had previously found relative safety there after Russia’s full-scale invasion of Ukraine.

“On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox. Somewhere in a national government office, an official sends an email to a colleague at a transnational military alliance. The message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious. But before the email leaves the building, a piece of code quietly examines it, decides that it is interesting, and sets aside a copy to be forwarded to prying eyes, while the original email continues on its way,” explains ESET researcher Matías Porolli.

“Because the tools rely heavily on serialization – a technique for packaging data and code for transport – we have given them names that start with the prefix ‘Cereal.’ What makes this toolset stand out is its combination of novel techniques requiring deep knowledge of Exchange internals, combined with unusual .NET execution methods,” adds Porolli, who discovered Turla’s new threat.

Reconstructing the attack chain revealed a modular toolset built around a few recurring design principles: keep payloads encrypted, keep execution in memory whenever possible, reuse the compromised Exchange server, and deliver commands as separate .NET assemblies. One of the most interesting aspects of this toolset is what ESET did not find: external C&C infrastructure. Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.
The use of various .NET tricks, such as unmanaged entry points, and abuse of the .NET native image cache make this toolset quite sophisticated in comparison to most recent APT cases that ESET has researched.

For more technical details about Turla’s latest toolset, check out the ESET Research blogpost and white paper “Exchange for breakfast: Turla’s Cereal tricks are not for kids,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Countries and sectors compromised by Turla’s Cereal toolset.

About ESET®

ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit www.eset.com or follow ESET’s social media, podcasts, and blogs.

A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/eb821cf4-ec81-4af2-b0b9-f56508bafd36

Media contact:
Jessica Beffa
jessica.beffa@eset.com 
720-413-4938

Countries and sectors compromised by Turla’s Cereal toolset.

Countries and sectors compromised by Turla’s Cereal toolset.