Turla uses new Cereal malware to quietly collect email from government Exchange servers
Because Cereal has no external servers to block, the compromised Exchange server itself becomes the only point an operator needs to control.
Russian state-linked group Turla has been running a previously undocumented toolset called Cereal against Microsoft Exchange servers to quietly collect email, according to ESET. The malware was first found at a Kazakh government body and then at a Romanian government organisation compromised on December 23, 2025, where it was set to pick up messages involving NATO and EU addresses. Cereal has no external command-and-control servers, so the compromised Exchange server itself acts as the only control point, which makes it harder to spot with conventional network monitoring. Its components run in memory inside legitimate Exchange processes and filter for messages carrying DOC, DOCX or PDF attachments before staging them for exfiltration. For teams that operate Exchange, the case is a reminder that mail servers can serve as long-term collection and execution points for espionage.
Why it matters
The case shows that a mail server can serve as a long-term collection point for state espionage without any outside command channel to detect. Government bodies in Eastern Europe and organisations linked to NATO and EU institutions are the ones directly exposed, since the Romanian attack targeted messages to addresses at those bodies. Because the malware hides inside normal Exchange processes and waits for messages with DOC, DOCX or PDF attachments, the risk is quiet and sustained rather than a single visible breach.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.