Russia-Linked Turla Deploys Cereal Toolset to Spy on NATO, EU Emails

The Russia-linked advanced persistent threat (APT) group Turla has deployed a new, sophisticated toolset named Cereal on compromised government Microsoft Exchange servers to conduct cyberespionage, collecting emails from targets including those linked to NATO and the European Union.

Cybersecurity researchers at ESET attributed the Cereal toolset with high confidence to Turla, also known as Snake and Uroburos. The group, widely believed to be part of Russia’s Federal Security Service (FSB), has been active since at least 2004.

New Cereal Toolset Capabilities

ESET’s research, published on 10 November 2026, revealed that Cereal is designed for stealthy, long-term cyberespionage. The toolset enables threat actors to execute commands in memory, map compromised organisations, and covertly gather selected messages through a new Exchange email collection module.

Crucially, Cereal kept its payloads encrypted and received commands as separate .NET assemblies, running the email collection module directly within Exchange’s own processes. ESET noted that Cereal combined deep knowledge of Exchange internals with unusual .NET execution methods, leaving minimal traces on disk.

Instead of relying on external command-and-control (C2) infrastructure, each compromised Exchange server was co-opted to act as a C2 itself, making detection and analysis significantly more challenging.

Geopolitical Targeting Focus

ESET identified two national government victims: one in Kazakhstan and another in Romania. In the Romanian instance, the Cereal toolset was specifically configured to pick out emails sent to or from NATO and European Union addresses.

This focus aligns with long-standing Russian intelligence priorities, particularly in Europe. ESET highlighted that the targeting of the Romanian victim, discovered a month after Cereal was first spotted in Kazakhstan on 28 November 2025, could be related to regional tensions, such as Russian drones crashing near or inside Romania since early 2025.

For the Kazakh victim, researchers suggested the targeting might aim to gain visibility into Russian dissidents, following reported deportations of some Russian exiles since January 2026. ESET telemetry indicates that approximately 70% of Turla’s targets since 2022 have been former Soviet republics or European states once closely aligned with the Soviet Union.

The discovery by ESET underscores Turla’s continued evolution in its tradecraft and its persistent focus on geopolitical intelligence gathering. ESET has provided indicators of compromise in its white paper and GitHub repository to assist organisations in detecting and mitigating Cereal activity.