Turla Malware Intercepts NATO And EU Government Correspondence Arabian Post

(MENAFN- The Arabian Post) clearfix"> Russia-linked cyberespionage group Turla infiltrated government email servers in Romania and Kazakhstan using previously undocumented malware capable of intercepting selected correspondence, including messages involving NATO and European Union institutions, cybersecurity company ESET disclosed on Tuesday.

The toolset, named Cereal, operates inside Microsoft Exchange servers and allows attackers to collect emails without disrupting their delivery. ESET attributed the operation to Turla with high confidence in research published on 10 November, identifying a Romanian government organisation and a government body in Kazakhstan as victims.

Investigators first detected the software at the Kazakh organisation on 28 November 2025. Further analysis uncovered an intrusion at the Romanian organisation, compromised on 23 December. The Romanian installation was configured to identify messages sent to or received from NATO and EU addresses, making institutional correspondence a particular target.

ESET did not identify the affected government agencies publicly. Its findings establish the malware's presence and collection capabilities but do not independently establish how much correspondence attackers ultimately obtained or whether NATO or EU networks themselves were breached.

The researchers described Cereal as a modular collection of malicious programs designed for prolonged access. Unlike conventional espionage malware that communicates with dedicated external servers, the toolkit uses the compromised Exchange server itself to receive instructions and return information, reducing the infrastructure defenders might identify and block.

Its principal backdoor, CerealNeuron, monitors incoming web requests disguised as ordinary Exchange service traffic. Requests containing valid encrypted instructions trigger commands executed within the server, while unrelated requests receive responses resembling normal application errors. ESET said it could not determine the internet addresses from which the operators connected.

See also UK and allies expose Integrity Tech cyber operations

Another component, CerealBox, embeds itself within Exchange's email transport process. It intercepts the functions of existing transport agents rather than registering a conspicuous new agent, enabling the software to examine messages as they pass through the system while routine delivery continues.

The module selects correspondence using predefined criteria, including sender and recipient addresses, subject text and attachment names. It can retain messages carrying Word documents or PDF files, compress and encrypt the collected material, and store it for subsequent retrieval by the attackers.

ESET researcher Matías Porolli said the approach allowed malicious code to examine a message before it left a government organisation, preserve a copy when it matched the attackers' interests and allow the original to continue to its destination without an obvious interruption.

The attackers also deployed command modules that could query Active Directory, enumerate network information, access locally stored credentials and read or delete files. These operations gave the intruders capabilities extending beyond email interception to reconnaissance and activity elsewhere within compromised systems.

A separate component, CerealHermit, processes encrypted commands stored in files rather than received over a network connection. Its presence suggests an alternative execution mechanism, although the researchers did not establish how operators supplied those files or collected the resulting output.

The toolkit uses encrypted payloads and unusual methods for running Microsoft's. NET code. Researchers found techniques involving unmanaged entry points and manipulation of the. NET native image cache, allowing malicious components to blend into legitimate software execution and leave relatively few recognisable files on disk.

The research also points to a method of packaging commands. Operators supplied separate compiled programs containing encrypted instructions, rather than relying on a single continuously running executable. ESET found numerous related files tailored to individual tasks, which it considered evidence of an organised framework for preparing operations. The design allowed components to be exchanged while keeping sensitive functions concealed until execution on the infected machine.

See also Suspected China-linked hackers penetrate US government-affiliated network

ESET based its attribution on the simultaneous deployment of another component previously associated with Turla and similarities between Cereal and the group's earlier software. Turla, also called Snake and Uroburos, has operated since at least 2004 and is widely assessed by security researchers and Western authorities to be linked to Russia's Federal Security Service.

The company said approximately 70% of countries targeted by Turla in its observations since 2022 were former Soviet republics or European states formerly aligned with the Soviet Union. The locations of the two identified intrusions therefore corresponded with an established geographical pattern, although geography alone does not establish responsibility.

ESET has published technical indicators intended to help security teams identify the toolkit. These include suspicious files and activity associated with Exchange processes, as well as distinctive web request paths used by the backdoor.

MENAFN12112026000152002308ID1111954569