cyber.hendryadrian.com
Threat Research · databreachtoday.com

ESET Links Turla to Exchange Server Espionage Targeting NATO- and EU-Related Emails

· Original article ↗

Summary

ESET says Turla used its modular .NET toolset Cereal on compromised Exchange servers in Kazakhstan and Romania to monitor and forward selected emails, including messages involving NATO and the EU.

Key points

  • ESET attributes the Exchange email collection module to Turla with high confidence, citing a shared malware component and similarities to older Turla tools.
  • Cereal is modular .NET malware that runs on Exchange servers, receives commands, executes code in memory, maps the organization, and collects selected emails.
  • Researchers found Cereal at a government organization in Kazakhstan in late 2025, where it monitored outgoing email and copied selected messages.
  • About a month later, researchers found the toolset at the Romanian government, configured to forward messages sent to or received from NATO and the EU.
  • ESET says no external command-and-control infrastructure was found; compromised Exchange servers instead served as operational hubs.
  • The reported infection chain involved encrypted payloads on disk, nested .NET assemblies, legitimate Windows processes loading suspicious DLLs, and Exchange services executing code.

Article Details

Attack Vectors
  • Turla deployed the Cereal .NET toolset on compromised Microsoft Exchange servers, where its backdoor waited for incoming web requests that could carry commands.
  • Cereal used encrypted payloads stored on disk, .NET assemblies embedded inside other .NET assemblies, and suspicious DLLs loaded by legitimate Windows processes.
  • The compromised Exchange server acted as the command-and-control hub; Cereal monitored outgoing email and copied selected messages to forward to the attackers.

MITRE ATT&CK

T1071.001 · Web ProtocolsCereal's backdoor waited for incoming web requests that looked like ordinary traffic to receive commands through the compromised Exchange server.T1114.002 · Remote Email CollectionCereal monitored outgoing email and collected selected messages from compromised Exchange servers, including messages involving NATO and the EU.

Threat Actors

TurlaESET attributed the Exchange email collection module to Turla with high confidence and described the group as aligned with Russia's Federal Security Service. The group used compromised Exchange servers to collect email; ESET also linked the campaign's malware component and conceptual similarities to Turla's publicly associated toolset and older artifact.

Malware

CerealThe previously undocumented toolset, dubbed Cereal, is "a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map the compromised organization, andLightneuronTurla has targeted Microsoft Exchange servers since at least 2014, using its LightNeuron backdoor to execute commands hidden in PDF or JPEG email attachments.

Vendors

ESETSecurity firm Eset, with high confidence, attributes the Exchange email collection module to the group aligned with Russia's Federal Security Service. The campaign shared a malware component with toolset publicly linkedMicrosoftRussian state-sponsored group Turla turned Microsoft Exchange email servers into attacker-controlled infrastructure for spying on messages involving the North Atlantic Treaty Organization and European Union, researchers

Products

Microsoft ExchangeRussian state-sponsored group Turla turned Microsoft Exchange email servers into attacker-controlled infrastructure for spying on messages involving the North Atlantic Treaty Organization and European Union, researchersMicrosoft Windows"encrypted payloads on disk, .NET assemblies embedded inside other .NET assemblies, legitimate Windows processes loading suspicious DLLs, and Exchange services executing code that did not belong there," Eset

Countries

KazakhstanIn late 2025, researchers found Cereal in a governmental organization in Kazakhstan, where it silently monitored outgoing emails and copied messages of interest to forward to attackers. A month later, targeted detectionRomaniaThe cyberespionage campaign in Romania may also reflect heightened regional tensions, Eset said, after the country called for a stronger NATO presence in response to Russian drones crossing into its territory, crashingRussiaEset, with high confidence, attributes the Exchange email collection module to the group aligned with Russia's Federal Security Service. The campaign shared a malware component with toolset publicly linked to

Industries

Governmentto attackers. A month later, targeted detection efforts uncovered the same toolset in the Romanian government, configured to forward emails sent to or received from NATO and the EU.

Related Articles