Russia-linked threat group Turla has deployed a new toolset called Cereal on compromised government Microsoft Exchange servers, in one case setting it to pick out emails sent to or from NATO and European Union addresses.

ESET has attributed Cereal with high confidence to Turla, also known as Snake and Uroburos, in research published November 10. The group has been active since at least 2004 and is widely assessed to be part of Russia's Federal Security Service (FSB).

The security company identified two national government victims, one in Kazakhstan and one in Romania. It found no external command-and-control (C2) infrastructure: each compromised Exchange server was co-opted to act as the C2 instead.

Cereal Turned Exchange Into a Collection Point

ESET wrote that the toolset was designed to take commands, run them in memory, map the compromised organization and gather selected messages through a new Exchange email collection module.

Cereal kept its payloads encrypted, received commands as separate .NET assemblies and ran the email collection module inside Exchange's own processes. According to ESET, the toolset paired techniques demanding a deep understanding of Exchange internals with unusual .NET execution methods.

"On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user's inbox," wrote Matias Porolli, the ESET researcher who discovered the threat.

ESET's research does not describe how the servers were first compromised, but its white paper and GitHub repository list indicators of compromise.

Government Victims Matched Turla's Regional Focus

Cereal was set to pick out NATO and EU emails at the Romanian victim, found a month after ESET first spotted the toolset in Kazakhstan on November 28, 2025.

ESET wrote that this focus fits long-standing Russian intelligence priorities but may also relate to regional tensions, including Russian drones crashing near or inside Romania since early 2025. For Kazakhstan, it pointed to reported deportations of some Russian exiles since January 2026, suggesting operators may want visibility into Russian dissidents.

Around 70% of the countries Turla has targeted since 2022 have been former Soviet republics or European states once closely aligned with the Soviet Union, based on ESET telemetry.

Read more on Turla: Palo Alto Reveals New Features in Russian APT Turla's Kazuar Backdoor

Cereal was built for long-term, stealthy cyberespionage, ESET concluded. In its assessment, the victims' Exchange servers became collection points, internal execution hubs and cover for Turla's .NET tradecraft, with little left on disk to find.