Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers compromised government email servers in Romania and Kazakhstan using a new malware toolkit called Cereal to intercept correspondence with NATO and EU officials.
The Slovak cybersecurity firm ESET attributed the campaign to Turla, a long-running Russian espionage group with ties to Russia's Federal Security Service (FSB). The hackers used a previously unknown toolkit called Cereal to monitor email traffic, steal specific messages and maintain access to compromised Microsoft Exchange servers without being detected.
The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes.
Attack Targets
Researchers first discovered the toolkit in November 2025 on a government email server in Kazakhstan and later identified it at a Romanian government organization. In Romania, the malware was configured to collect emails exchanged with NATO and EU institutions, coming amid rising tensions between Russia and NATO over the war in Ukraine.
In Kazakhstan, the intrusion took place amid growing scrutiny of Russian exiles and Kremlin critics living in the country, though researchers could not determine whether the hackers were specifically seeking information about dissidents.
Unusual Technique
The campaign stands out for its unusual approach to concealing the hackers' activities. Rather than relying on separate servers to control the malware, the attackers used the victims' own compromised Exchange servers to issue commands and manage the operation.
Abusing a compromised Exchange server as a central operational hub is a rare technique, used by only a handful of APT groups.
One component called CerealBox was embedded directly into a Microsoft Exchange service responsible for processing email traffic, allowing attackers to identify and capture messages of interest as they passed through the server.
Related
