Russian Turla Group Spies on NATO and EU Emails

The Russian state-sponsored hacking group Turla hijacked Microsoft Exchange email servers to spy on communications involving the European Union and the North Atlantic Treaty Organization. Security firm ESET identified a previously undocumented .NET malware toolset, dubbed Cereal, which allows attackers to map compromised organizations and collect specific email messages containing Word or PDF attachments.

The malware is designed for extreme stealth by co-opting the victim's own Exchange server to act as the command-and-control infrastructure, eliminating the need for external attacker infrastructure. ESET first detected the Cereal toolset in November 2025 during an attack on a government agency in Kazakhstan. Researchers later discovered the same toolset within a Romanian government organization in December 2025.

ESET attributes the campaign to Turla, a group aligned with Russia's Federal Security Service. The targets align with Russian intelligence priorities regarding former Soviet republics and European nations. The intrusions in Romania followed the country's calls for a stronger NATO presence, while the Kazakhstan breach may be linked to the deportation of Russian dissidents.