Russian cyberespionage group Turla has deployed a previously undocumented malware framework against government organizations in Romania and Kazakhstan, exploiting Microsoft Exchange infrastructure to monitor communications and selectively collect email messages. The operation involved a collection of interconnected .NET-based tools that allow attackers to execute commands, examine organizational networks and maintain access without relying on conventional external command-and-control infrastructure.
Slovak cybersecurity company ESET identified the framework, named Cereal, during an investigation that began on November 28, 2025, when researchers discovered suspicious components on a Kazakh government Exchange server. Further analysis and improved detection capabilities led to the identification of another deployment at a Romanian government organization, which had been compromised on December 23, 2025.
The Romanian intrusion attracted particular attention because the attackers had configured the malware to identify correspondence involving NATO and European Union institutional email addresses. This targeting coincided with escalating tensions between Russia and NATO, including repeated incidents involving Russian drones entering or crashing near Romanian territory.
The Kazakhstan incident presents a different intelligence context. Researchers noted that the compromise occurred amid increasing pressure on Russian exiles and Kremlin critics residing in the country. Access to government communications could potentially provide intelligence about individuals known to local authorities. However, ESET could not establish whether gathering information about dissidents was the actual objective.
Cereal Exploits Exchange's Internal Architecture
Unlike conventional email-stealing malware that operates as an independent application, Cereal integrates its collection capabilities into Microsoft's existing email-processing environment. Its CerealBox component operates inside EdgeTransport.exe, the Exchange service responsible for handling incoming and outgoing messages.
The component uses an unconventional method to intercept email processing. Rather than installing itself as a separately registered Exchange transport agent, it modifies the handlers of existing agents while operating in memory. This allows its malicious instructions to execute alongside legitimate email-processing functions without introducing an additional agent into the server's configuration.
CerealBox examines messages against predefined collection conditions involving sender and recipient addresses, subject lines and attachment names. Messages containing Word documents or PDF files can also qualify for collection when they match the configured filters. Selected communications are compressed, encrypted and temporarily stored for subsequent retrieval by the attackers.
The original email delivery process continues operating, meaning users may not experience an obvious interruption even while selected correspondence is being copied.
Compromised Servers Replace External Command Infrastructure
Another unusual feature concerns how Turla operators communicate with the malware. ESET did not identify dedicated external command-and-control servers in the investigated deployments. Instead, the attackers used the compromised Exchange infrastructure itself to receive instructions and coordinate malicious activity.
CerealNeuron facilitates this arrangement by operating as a passive backdoor. It monitors incoming web requests through paths associated with legitimate Exchange services, including Outlook Web Access, Autodiscover and ActiveSync. Requests containing properly encrypted instructions can be processed as commands, while invalid requests are redirected to legitimate-looking Exchange error pages.
CerealHermit provides an alternative execution mechanism by retrieving encrypted instructions from local files rather than accepting network requests. Both components can provide operators with access to compromised environments.
The framework also includes CerealLoader, CerealRunner, CerealSprinter, CerealIron and CerealMoth, which support payload loading, execution, process injection and the execution of individual .NET assemblies. These components allow attackers to perform activities such as querying Active Directory, retrieving mailbox contents, examining running processes, collecting stored credentials and accessing files.
ESET also documented the abuse of lesser-known .NET execution mechanisms, including native entry points, VTable Fixups and the framework's precompiled assembly cache. These techniques help malicious code execute through legitimate Windows and Exchange processes while reducing the visibility of its actual functionality.
Romanian Authorities Confirm Disruption
Romania's Intelligence Service (SRI) confirmed on November 11 that its National Cyberint Center had identified the intrusion in December 2025 and implemented countermeasures to contain it.
According to
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Russian Hackers Exploit Government Email Infrastructure in Romania and Kazakhstan