Turla Implants CerealBox in Exchange Servers to Intercept NATO-EU Mail in Romania, Kazakhstan
Turla’s Cereal toolkit abused victim Exchange servers as sole command hubs to steal NATO and EU correspondence from Romania and Kazakhstan. Technical evidence shows in-process interception without external infrastructure, consistent with long-running FSB-linked operations focused on post-Soviet targets. The approach evades standard detection and signals continued risk to alliance communications.
ESET discovered the Cereal toolkit on a Kazakhstan government Exchange server in November 2025 and later on a Romanian counterpart configured to harvest messages with NATO and EU addresses. The CerealBox component hooks the transport service to inspect and exfiltrate selected traffic without writing additional files or contacting external infrastructure. Technical indicators match Turla’s prior Exchange abuse patterns but introduce undocumented in-process interception logic.
The 70 percent concentration of Turla operations since 2022 on former Soviet republics and states with historical Soviet ties indicates a deliberate focus on regional communications rather than opportunistic targeting. Romanian deployment coincides with documented Russian drone incursions near NATO airspace; Kazakh deployment occurs amid increased Kremlin scrutiny of exiles. Both cases exploit the absence of external C2, reducing detection surfaces that defenders normally monitor.
No independent technical attribution beyond ESET’s code and behavioral matches has been published. Official statements from Bucharest and Astana remain silent on the intrusions. The technique demonstrates Turla’s continued investment in stealthy, infrastructure-light persistence on high-value mail servers.
Similar implants are expected on other national Exchange deployments handling alliance traffic. Defenders should prioritize memory and process-integrity monitoring of Exchange services over network indicators alone.
Sources (2)
- [1]ESET Turla Cereal Research(https://www.eset.com/int/about/newsroom/research/turla-cereal-toolkit/)
- [2]The Record on Romania Kazakhstan Intrusions(https://therecord.media/russia-hackers-espionage-romania-kazakhstan)