Anas SahelIdentity & security

Threat watch / Threat actors

Turla

State-linked updated 12 Nov 2026

A Russia-aligned espionage group active since at least 2004, according to ESET, which mostly targets governments in former Soviet republics and in Europe.

Attribution

ESET attributes the Cereal toolset, found on government Exchange servers in Kazakhstan and Romania, to Turla "with high confidence", based on another component publicly linked to Turla and similarities with older Turla malware. [1]

The Record and BleepingComputer describe Turla as a Russian espionage group linked to Russia's Federal Security Service (FSB). [2][3]

Romania's intelligence service (SRI) attributes the attack on a Romanian government institution's email service, which it says it identified in December 2025, to the Russian cyber actor "APT TURLA". [4]

Incidents in the watch

  1. Turla turned government Exchange servers in Kazakhstan and Romania into spy hubs High

← All threat actors