Security · High impactFan score 69 · Tier A4 sources

Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments

The Brief · written from 4 sources

Russia-aligned group Turla (aka Snake) is using a previously undocumented .NET toolset called Cereal.
The toolset was used against Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, to copy selected email from the mail flow.
ESET researchers found the malware, and CyberScoop reports Turla has used the toolset to compromise governments over the past year.

Why it matters

Attackers with this toolset can quietly collect email from Exchange servers, so organizations running Exchange, especially government bodies, should consider whether their mail servers could be compromised.

Who’s affected

Government organizations running Microsoft Exchange servers
Teams operating on-premises Exchange email infrastructure

#espionage
#turla
#microsoft-exchange
#malware
#email-security
#government

Turla, a notorious cyberespionage group aligned with the Russian government, has been wielding a new, customizable toolset to compromise governments around the world over the past year, including Kazakhstan. The toolset was first discovered in November 2025 by cybersecurity firm…

Read the full story at cyberscoop.com ↗