Skip to content
securitytabs

Covered by 2 outlets — first reported by Infosecurity Magazine, Nov 10, 14:30 UTC

Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails

MentionsTurlaESETExchange ServerMicrosoft

Summary

ESET says the Russia-linked hacking group Turla used a previously undocumented toolset it calls Cereal on Microsoft Exchange email servers at government bodies in Kazakhstan and Romania. ESET says it first found the toolset on 28 November 2025 at a Kazakhstan government body. Infosecurity Magazine reports the compromised servers were used to collect emails linked to NATO and the EU.

AI summary by the SecurityTabs newsroom, checked against Infosecurity Magazine, Security Affairs. Read the outlets below for the full story.

SecurityTabs reportupdated 10h agoESET: Russia-aligned Turla uses new Cereal malware to spy on Exchange email

Continue reading

2 outlets, in the order they reported it.

  1. Infosecurity MagazineFirst report

    Russia-Linked Turla Hijacks Exchange Servers to Spy on NATO and EU Emails

    Turla used compromised Exchange servers to collect NATO and EU-linked emails

    Read at Infosecurity Magazine Details

  2. Security Affairs

    Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room

    ESET found Russia-Linked APT group Turla using a new toolset, dubbed Cereal, on government Exchange servers in Kazakhstan and Romania.

    Read at Security Affairs Details

Explained

The technology and terms in this story. Learn more