ESET details Turla malware that intercepts government Exchange email

ESET has disclosed a malicious toolset called Cereal that it attributes to Russian state-backed hackers Turla. Researchers found it on government Exchange servers in Kazakhstan and Romania in late 2025. In Romania, it selectively collected correspondence with NATO and EU representatives. One component intercepts email inside an existing Exchange process without registering a new transport agent or interrupting delivery. Another receives encrypted commands through web requests resembling legitimate Exchange traffic. ESET observed no external command infrastructure; the compromised server itself served as the control point.