ESET attributes to Turla spyware that read emails with NATO and the EU at a Romanian public body

Slovak cybersecurity company ESET published a report on November 10 on Cereal, a set of malicious programs for Microsoft Exchange email servers that it attributes to the espionage group Turla. ESET describes Turla as a group active since at least 2004 and widely considered to be part of Russia's Federal Security Service (FSB).

According to ESET, its researchers found the tools on November 28, 2025 on an Exchange server at a public body in Kazakhstan and, a month later, at a public body in Romania. BleepingComputer reports from the report that the Romanian body was compromised on December 23, 2025. In Romania, one of the components was configured to collect messages involving NATO and EU institutional addresses, according to ESET.

According to the report, the program embeds itself in legitimate Exchange processes to inspect email without interrupting its delivery and does not use external control servers: the compromised server itself acts as the command point. BleepingComputer says the attackers were mainly looking for messages with document attachments.

According to The Record, ESET has not been able to determine how the attackers obtained initial access to the servers or how much information they obtained. Neither government has commented on the report in the sources consulted.