Threat watch / Attack
Turla turned government Exchange servers in Kazakhstan and Romania into spy hubs
On November 10, 2026, ESET disclosed Cereal, a new toolset hidden inside the Microsoft Exchange servers of two national government bodies, one in Kazakhstan and one in Romania. It picked out emails with Word or PDF attachments, and in Romania it was set to collect mail to or from NATO and EU addresses. ESET attributes it to Turla with high confidence, and Romania's intelligence service (SRI) also names Turla. The SRI says the attackers exploited vulnerabilities in Microsoft operating systems and that no exfiltration of sensitive data was identified in Romania.
- Sector
- Government & politics
- Way in
- Software flaw
- Product or vendor
- Microsoft Exchange
- national government organizations compromised[1]
- 2
- How it happened
- The toolset was injected into Exchange's EdgeTransport.exe process and hooked the server's existing transport agents to read mail. The compromised Exchange server itself served as the command hub: ESET found no external command-and-control infrastructure. ESET could not determine how the attackers first got in. On November 11, Romania's intelligence service (SRI) said the attackers "exploited a series of systemic vulnerabilities" in Microsoft operating systems, without naming them.[1][2][3][4] Checked 12 Nov 2026
- What was stolen
- Emails with .doc, .docx or .pdf attachments that matched lists of senders, recipients or subjects; in Romania, mail to or from NATO and EU addresses. The tools could also pull mailboxes, query Active Directory and extract stored credentials (LSA secrets). How much was taken is not known. For the Romanian case, the SRI says no exfiltration of sensitive data was identified.[1][2][3][4] Checked 12 Nov 2026
- Who was impacted
- Two national government organizations, one in Kazakhstan and one in Romania, which ESET does not name.[1] Checked 12 Nov 2026
- Threat actor
- Turla →
Timeline
- ESET finds the toolset on an Exchange server of a government organization in Kazakhstan. [1]
- A government agency in Romania is compromised, according to ESET, which found it about a month after the Kazakh case. [1][3]
- ESET says activity in Kazakhstan surged on this date. [1]
- ESET publishes its research and attributes Cereal "with high confidence" to Turla, citing another component publicly linked to Turla and similarities to older Turla malware. ESET calls the use of a compromised Exchange server as the central hub "a rare technique", according to The Record. [1][2]
- Romania's intelligence service (SRI) confirms the attack on a Romanian government institution, which it does not name, and attributes it to the Russian actor APT Turla. It says it identified the attack in December 2025, that the attackers exploited vulnerabilities in Microsoft operating systems, that no exfiltration of sensitive data was identified and that the affected email service has been restored. [4][5]