Turla's Cereal toolkit turned compromised Exchange servers into covert command posts
ESET researchers found that Turla's Cereal toolkit turned two national governments' own Microsoft Exchange servers into covert command posts, leaving no external control server for defenders to block. The compromises were found in Kazakhstan in November 2025 and Romania a month later.
In Romania, one collection module was configured to flag messages sent to or received from NATO and European Union addresses. The main backdoor did not call out to an attacker server; it waited on ordinary-looking Exchange web paths for properly encrypted requests and ran the commands they carried.
Operators delivered separate compiled .NET command programs that ran in memory, while CerealBox was injected into Exchange's email transport process to copy selected messages and stash them on disk. ESET could not identify the operators' ingress IP addresses, and published indicators in its GitHub repository and accompanying white paper for defenders to review.
Sources & technical scope 1 source
ESET Research — original source ↗
Exploitation: Known exploitation: two confirmed government compromises (Kazakhstan, November 28, 2025; Romania, December 23, 2025). A KEV catalog listing is not established by supplied evidence.
Scope & limitations: No product versions, CVEs, patches, fix mechanics, or broader victim telemetry are supplied. Scope is limited to the two confirmed organizations; Turla attribution is ESET's high-confidence assessment based on the supplied reporting.
External findings belong to the credited researchers.