Turla, the Russian espionage group linked to the Federal Security Service (FSB), compromised the Microsoft Exchange email server of a Romanian government institution using a toolkit nobody had documented before, according to research ESET published on 10 November 2026. ESET calls the toolkit Cereal. It was set up to find and collect emails exchanged with NATO and European Union addresses. The Romanian Intelligence Service (SRI) confirmed the attack on 11 November. It says its National Cyberint Centre found the intrusion in December 2025, stopped it, and found no exfiltration of sensitive data. ESET disagrees with parts of that account. It saw related activity in January 2026, after the point SRI says the attack was stopped, and says it cannot rule out that sensitive information was taken. Neither side has named the Romanian institution.
What Happened
ESET first found the Cereal toolset on 28 November 2025 at a government organisation in Kazakhstan. BleepingComputer reports that the researchers then "fine-tuned" their detections and found the same toolset about a month later at a Romanian government organisation, which they say was compromised no later than 23 December 2025. Digi24, citing ESET's analysis, reports that attacker activity on the Romanian system increased on 20 January 2026.
SRI's account is shorter. A spokesperson, Ovidiu Marincea, told Europa FM that the service found the attack in December 2025 and put countermeasures in place. He said the attack was stopped and the affected email service was restored. SRI says it informed the officials legally entitled to receive its intelligence and worked on the case with European intelligence partners, the EU and NATO. The Romania Journal and News.ro report that SRI described the investigation as ongoing and connected to other Russian cyber campaigns.
The two timelines do not fully match. ESET researcher Robert Lipovský told Antena 3 CNN, as reported by Jurnalul Național, that ESET saw activity linked to the attack in January 2026. ESET has not said publicly what that activity was. Nobody has said whether it happened at the same Romanian institution or whether the attackers got back in after SRI's response.
What Was Taken
This is still disputed. Some headlines say NATO and EU emails were stolen, and Cybernews describes the toolkit as stealing particular messages. The accounts closest to the incident are more careful:
- SRI says "no exfiltrations of sensitive data were identified."
- ESET, according to Cybernews, does not know how much data the attackers took. Lipovský said ESET cannot rule out that sensitive information was taken because it does not have the data needed to see what left the network.
- Digi24 and Jurnalul Național, both summarising ESET's technical write-up, report that ESET showed how messages were selected, compressed, encrypted and staged on the server for collection. They add that ESET has not shown that any staged message actually left the network.
According to BleepingComputer and Digi24, the toolkit was configured to look for:
- Messages to or from addresses ending in nato.int and europa.eu.
- A short list of named people who appear to work on government matters involving NATO and the EU.
- Messages with .doc, .docx or .pdf attachments, filtered by sender, recipient, subject and filename.
Both Romanian outlets also point out that the targeted messages were held on the Romanian server. Nothing published describes a compromise of NATO or EU systems themselves.
Why It Matters
Turla has been active for more than 20 years and is also tracked as Snake, Secret Blizzard and Waterbug. Europa FM notes that it has a history of targeting foreign ministries, defence ministries and embassies. Cereal shows the group investing in long-term access to email servers rather than to individual mailboxes. If an attacker controls the transport layer of an Exchange server, every message that passes through it is exposed, and nothing has to be installed on user machines or in mail clients.
ESET describes the toolkit as "a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes." Cybernews reports that the operators used the victim's own Exchange server as their control hub. That weakens defences that depend on blocking known attacker domains or spotting unusual outbound connections. BleepingComputer quotes ESET saying the large number of near-identical binaries, each compiled for one task, points to an organised internal development process. Defenders should expect versions built for other targets.
The gap between ESET's findings and SRI's statement matters too. When a national agency says an attack was stopped and the vendor that found it says it cannot rule out data theft, NATO and EU partners have no clear basis for judging what was exposed.
The Attack Technique
Initial access is not known. Cybernews reports that ESET does not know how the attackers got in. SRI says they "exploited a series of systemic vulnerabilities in Microsoft operating systems" but has not named any vulnerability or CVE.
What ESET has documented is what happened after the attackers were inside. BleepingComputer reports these components:
- CerealBox injects into Exchange's EdgeTransport.exe process and takes over the handlers of transport agents that are already registered. It inspects mail in memory without registering a new transport agent and without interrupting normal delivery. Reviewing the list of installed transport agents would show nothing new.
- CerealNeuron waits for incoming encrypted web requests on URL paths that look like normal Exchange services. It checks and decrypts each request, then runs the payload it contains.
- CerealRunner is a wrapper around whatever code the operators want to run. Reported capabilities include pulling emails from Exchange, querying Active Directory for users, groups and DNS records, extracting locally stored credentials, and reading or deleting files, including the staged email archives.
What Organizations Should Do
- Check EdgeTransport.exe for injected code. Cereal does not add a transport agent, so reviewing installed agents is not enough. Use memory scanning or EDR telemetry to look for unexpected .NET assemblies loaded into EdgeTransport.exe and for unusual behaviour by existing agent handlers.
- Review Exchange web request logs for unusual paths. Look for encrypted POST requests to endpoints that resemble Exchange services but are not in your expected URL baseline. Also check where those requests come from.
- Look for staged archives on mail servers. Compressed or encrypted files in odd directories on Exchange hosts, especially ones created and then deleted, can show collection activity even when exfiltration cannot be confirmed.
- Keep enough logs to answer "what left?". ESET says it could not determine what data left the network. Keep network flow data and Exchange message tracking logs long enough to answer that question months after an intrusion.
- Patch and reduce exposure of on-premises Exchange. SRI's reference to exploited Microsoft vulnerabilities is a reason to apply all Exchange and Windows Server updates, limit internet exposure of Exchange services, and move sensitive correspondence toward platforms with stronger isolation.
- Rotate credentials after any mail server compromise. Cereal can extract locally stored credentials and query Active Directory. Treat service accounts, admin accounts and anything cached on the Exchange host as compromised, and look for lateral movement from the mail tier.
Sources: Russian hackers breach Romanian government email servers Cybernews | Turla hackers use new Cereal malware to spy on govt Exchange servers | SRI confirmă atacul hackerilor ruși APT Turla și precizează că nu a... | Romania Foils Russian Turla Cyberattack on Government Agency - The... | Schimbul de mesaje dintre România și NATO, dar și cu UE, intercepta... | Russian espionage at a government institution in Romania. Hackers a... | SRI anunţă că a oprit un atac cibernetic desfăşurat, la sfârşitul a... | Poșta unei instituții de stat din România a fost compromisă