{"id":287,"date":"2026-11-10T11:10:24","date_gmt":"2026-11-10T10:10:24","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/turla-intercepts-emails-to-nato-and-the-eu-via-exchange-servers\/"},"modified":"2026-11-10T11:10:58","modified_gmt":"2026-11-10T10:10:58","slug":"turla-intercepts-emails-to-nato-and-the-eu-via-exchange-servers","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/it-news\/turla-intercepts-emails-to-nato-and-the-eu-via-exchange-servers\/","title":{"rendered":"Turla intercepts emails to NATO and the EU via Exchange servers"},"content":{"rendered":"

Researchers at ESET have discovered a new toolset that runs on Microsoft Exchange servers and collects selected emails. The security firm has named the toolset Cereal and attributes it with a high degree of confidence to the Russian APT group Turla. At a government organisation in Romania, the malware was configured to target messages to and from NATO and the EU.<\/strong><\/p>\n

ESET found Cereal in late 2025 at two national government organisations, one in Kazakhstan and one in Romania. According to the company, the toolset receives commands on Exchange servers and executes them in memory. It also maps the compromised organisation and collects selected email messages. The name refers to serialisation, a technique for packaging data and code for transport. According to ESET, the tools rely heavily on it.<\/p>\n

How the toolset works<\/h3>\n

ESET describes a modular structure built around a number of recurring design principles. Payloads remain encrypted, execution takes place in memory wherever possible and commands are sent as separate .NET assemblies. A module for collecting emails is injected into legitimate Microsoft Exchange processes. This gives the module access to the email transport pipeline, which it can also manipulate. Another component is a passive backdoor on the Exchange server that provides access to the internal network.<\/p>\n

The researchers found no external command-and-control (C&C) infrastructure. Instead, the victim’s compromised Exchange server itself acts as the C&C server. As a result, there is no infrastructure for defenders to detect and block. According to ESET, the toolset also leaves few traces on disk. The company further points to the use of .NET techniques such as unmanaged entry points and abuse of the .NET native image cache. ESET describes this as unusual compared with most recent APT cases it has investigated.<\/p>\n

ESET researcher Mat\u00edas Porolli, who discovered the toolset, outlines how this works in practice. A civil servant sends an email to a colleague at a military alliance and the message passes through the Exchange server as usual. Before the email leaves the building, a piece of code assesses the message and, if it is of interest, sets aside a copy to be forwarded. Meanwhile, the original arrives as normal. Porolli states that the techniques used require a thorough knowledge of Exchange’s inner workings.<\/p>\n

Targets in Romania and Kazakhstan<\/h3>\n

In Romania, the CerealBox component was configured to collect messages addressed to or originating from NATO and EU institutions. ESET links this focus to the long-standing priorities of Russian intelligence services. The regional context may also play a role: since early last year, Romania has reported several incidents involving Russian drones crashing in or near Romanian territory. In the case of the attack in Kazakhstan, ESET points to reports that since January 2026 the country has been expelling Russian refugees and critics who had fled there following Russia’s invasion of Ukraine.<\/p>\n

Background on Turla<\/h3>\n

According to ESET, Turla, also known as Snake, has been active since 2004 and is widely regarded as part of Russia’s Federal Security Service (FSB). Based on the company’s telemetry, around 70 per cent of the countries Turla has attacked since 2022 are former Soviet republics or European countries that were closely tied to the Soviet Union. According to ESET, the victims of Cereal fit this pattern. Technical details of the attack chain can be found in the whitepaper Exchange for breakfast: Turla’s Cereal tricks are not for kids<\/a>.<\/p>\n

The full report can be read at Exchange for breakfast: Turla’s Cereal tricks are not for kids<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

ESET has found a Turla toolset harvesting emails on government Exchange servers in Romania and Kazakhstan. The hacked server itself acts as C&C, eliminating external infrastructure.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169629,"mspb_url_nl":"https:\/\/mspbusiness.com\/algemeen\/turla-onderschept-e-mails-aan-navo-en-eu-via-exchange-servers\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/it-nachrichten\/turla-faengt-e-mails-an-nato-und-eu-ueber-exchange-server-ab\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/11\/hero-1794305412098.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/11\/hero-1794305412098.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"ESET uncovers Cereal, a Turla toolset that intercepts government emails via Exchange servers, including messages to NATO and the EU.","footnotes":""},"categories":[1],"tags":[],"layout":[6],"class_list":["post-287","post","type-post","status-publish","format-standard","hentry","category-it-news","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=287"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/287\/revisions"}],"predecessor-version":[{"id":288,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/287\/revisions\/288"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=287"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}