02.09.2025
2 min
750
Russian hackers from the Turla group breached Romanian government email servers to intercept electronic communications, including messages involving NATO and European Union representatives. For the espionage operation, they used a previously unknown malware toolkit called Cereal, which allowed them to secretly copy targeted emails.
According to ESET, the attack was carried out by Turla, a hacking group linked to Russia’s Federal Security Service (FSB). Its new Cereal toolkit allows attackers to monitor email traffic, steal selected messages, and maintain covert access to compromised Microsoft Exchange servers.
“The Cereal toolkit is a carefully engineered solution for long-term covert cyberespionage. It leaves few traces on disk, does not rely on external infrastructure that could be detected and blocked, and hides within legitimate Exchange processes,” ESET researchers said.
The malware operates without attracting users’ attention. When a government official sends an email to a colleague in another NATO country, malicious code checks the message while it is still on the Exchange server. If the email matches the hackers’ interests, the system saves a copy for later theft, while the original message reaches its intended recipient without interruption.
As ESET researchers explained, they first discovered this mechanism in late 2025 on a server belonging to a government institution in Kazakhstan. Shortly afterward, they identified the same toolkit at a Romanian government organization that had been compromised on December 23, 2025. In that case, Cereal was configured to search for emails sent to or received from NATO and EU representatives.
According to ESET specialists, Cereal combines new attack techniques requiring a deep understanding of Microsoft Exchange’s internal architecture with unusual methods of executing .NET code. Researchers were particularly interested in the absence of external command-and-control (C&C) infrastructure, which hackers typically use to manage infected systems.
Instead, Turla turned the compromised Exchange server itself into the attack’s command center. This approach allowed the group to operate without external servers that defenders could detect, block, or shut down.
ESET noted that using a compromised Exchange server as a central command-and-control node is a rare technique employed by only a handful of APT groups. Turla had previously used similar approaches, but this particular implementation had not been documented in other malware families. Researchers have also yet to determine how the hackers initially gained access to the government servers or how much information they managed to steal.
Turla, also known as Snake, has been active since at least 2004. Its primary targets include government agencies, diplomatic missions, and defense organizations across Europe, Central Asia, and the Middle East. The group was previously exposed for conducting extensive surveillance of foreign embassies and diplomatic missions in Moscow. During those operations, the attackers exploited access at the internet service provider level.
The group’s interest in Romania may be linked to rising tensions in the region. Since early 2025, Romania has repeatedly reported Russian drones crashing near its borders or directly on its territory. Meanwhile, the breach in Kazakhstan coincided with the beginning of deportations involving some Russian emigrants and Kremlin critics who had left Russia following its full-scale invasion of Ukraine.
The exact scale of the cyberespionage operation remains unknown. However, the discovery of Cereal indicates that Turla continues to refine its techniques for maintaining covert access to government email systems.
