ESET ties Russian Turla group to e-mail server breaches in Romania and Kazakhstan

ESET attributed the compromise of government e-mail servers in Romania and Kazakhstan to Turla, a Russian state-linked group tied to the Federal Security Service, after researchers at the Slovak cybersecurity firm discovered the undocumented Cereal toolkit at a Kazakh governmental organization on Nov. 28, 2025, and at a Romanian government body on Dec. 23, 2025.

In Romania, researchers said the tool gathered messages involving NATO and European Union bodies. Instead of using external servers, the operators ran the campaign through the compromised government Exchange servers themselves, and researchers saw no attacker-controlled command and control servers; the hacked Exchange server acted as the sole control point. ESET said CerealBox ran inside EdgeTransport.exe, the Microsoft Exchange process that handles mail flow, and the toolkit compressed, encrypted and stored selected e-mail on disk before other toolkit components retrieved and deleted them.

CerealBox hijacked handlers belonging to transport agents, which route and process e-mail as it moves through Exchange, already loaded in memory, letting attackers capture messages without registering a new transport agent. The component targeted messages with .doc, .docx or .pdf attachments if they matched hardcoded lists covering senders, recipients, subjects and file names, and it used ignore lists to exclude unwanted matches from collection. Malicious wrappers inspect messages and then hand control back to the original code, Matías Porolli of ESET said, “the message goes out through a Microsoft Exchange server, exactly as it should, and nothing looks suspicious.”

The main backdoor, CerealNeuron, listened for encrypted web requests on paths designed to look like normal Exchange traffic, including Outlook Web Access and Autodiscover, and specifically on paths such as /owa/sdds/ and /autodiscover/proxyservice/. It avoids periodic outbound connections, and the server redirects invalid requests to an Exchange error page. CerealNeuron encrypts output and returns it to attackers, and it executes a supplied CerealRunner wrapper program that carries attacker code.

The loader exploited the .NET native image cache (a store of precompiled libraries that Exchange loads at startup), so Exchange would load malicious code instead of a legitimate library, and it posed as ncobjapi.dll in C:\Windows\System32\wbem. Operators dropped copies into the .NET native image cache under names such as Microsoft.Exchange.Search.Mdb.ni.dll, and Exchange starts with the malicious file before reverting to the genuine library. The loader is the single component stored on disk that appears as a recognizable .NET file, and it executed native code before its normal .NET start point while pretending to be Windows DLLs.

The toolset includes eight components: CerealRunner, CerealLoader, CerealSprinter, CerealIron, CerealMoth, CerealNeuron, CerealHermit and CerealBox. CerealSprinter decrypts and runs CerealNeuron, CerealHermit and CerealBox, while CerealLoader loads a .NET assembly and executes it using an encrypted file kept on disk. CerealIron injects .NET assemblies into non-.NET processes, CerealMoth loads an assembly and runs a specified method, and CerealHermit does not use the network, instead getting instructions from encrypted files stored on disk.

Commands can query Active Directory for DNS records and computers, list volume snapshots and support Windows Management Instrumentation queries. Delivered programs can inspect processes and network connections, and the programs send results back to CerealNeuron for encrypted exfiltration. ESET said CerealHermit may serve as a fallback or redundancy system and writes encrypted results, though the firm did not explain how attackers place its command files on disk or retrieve results.

ESET attributes Cereal to Turla with high confidence, basing the attribution on a shared malware component and conceptual similarities with older artifacts. Matías Porolli of ESET said, “the impression is one of a mature, well-engineered platform – rather than a loose collection of scripts.”

Turla is a long-running group that has operated since at least 2004 and the group has ties to Russia’s Federal Security Service. Turla also goes by the aliases Snake, Secret Blizzard, Venomous Bear, Waterbug and Uroburos.

ESET said Turla has attacked Microsoft Exchange servers since at least 2014 using LightNeuron to run commands hidden in PDF or JPEG files, and the group has used different versions of this server control method. ESET said only a few advanced persistent threat groups have used a hacked e-mail server as a central operations hub, and no malware family has used this method of hooking Exchange e-mail flow internally.

About 70 percent of Turla targets since 2022 were former Soviet republics or European states with Soviet ties, ESET telemetry shows, and the firm said Turla’s targets match Russian intelligence priorities with a focus on former Soviet republics and European states once closely aligned with the Soviet Union. The group has long targeted government agencies, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East. ESET described Exchange servers as durable collection points and internal execution hubs, and said compromised Exchange servers provided cover for Turla’s .NET tradecraft with little left on disk.

The Romanian incident followed repeated Russian drone flights near its territory during the war in Ukraine, and Romania called for a stronger NATO presence after Russian drones crossed into its territory, crashing and injuring civilians. Russian drones have crashed near or inside Romania since early 2025. In Kazakhstan, reported deportations of Russian exiles began in January 2026, including one who volunteered for opposition leader Alexei Navalny, and ESET said Russian authorities might want intelligence about those exiles.

Activity in Kazakhstan surged on Jan. 15, 2026, the day after Old New Year, though researchers said they could not determine if the hackers sought information about dissidents. ESET did not know how the intruders first got into the government servers, could not determine how much information the attackers obtained, and could not identify the operators’ ingress IP addresses.

Checking registered transport agents or outbound connections alone would miss key toolkit elements, ESET said, because the toolset features a small disk footprint and most components run in memory. Malicious traffic coexists with legitimate services and decrypts only after integrity checks, and operator IP addresses are not readily revealed by network-based tracking. ESET posted indicators of compromise for researchers on its public GitHub repository.