FSB-linked Turla hit Romanian Exchange to siphon NATO/EU mail

Key facts

• ESET says Romanian government organisation Microsoft Exchange servers were compromised on 23 Dec. 2025 to collect NATO/EU-related emails.
• The modular .NET toolset “Cereal,” including “CerealBox,” filtered for NATO/EU institutional addresses and prioritised Word/PDF attachments, then compressed and encrypted copies for later retrieval.
• ESET attributes the activity to Turla with high confidence, describing stealth features that used the victim’s own Microsoft servers as infrastructure to reduce external C2 signals.

3 minute read

ESET reports that hackers attributed with high confidence to Turla—an advanced persistent threat widely assessed as affiliated with Russia’s FSB—compromised a Romanian government organisation’s Microsoft Exchange servers in late December 2025 to harvest email traffic linked to NATO and the European Union. The intrusion, disclosed publicly on 10 November, used an “advanced suite of tools” ESET dubbed Cereal, described as previously undocumented modular .NET malware designed to run on Exchange, receive operator commands, execute them in memory, map the compromised environment, and selectively collect email messages.

The operational intent was collection rather than disruption. ESET says emails transiting Romanian government servers were scanned for relevance to NATO and EU topics; when criteria were met, the malware created copies for exfiltration. A specific module, CerealBox, focused on messages involving NATO and EU institutional addresses and applied predefined filters to pick emails with Word or PDF attachments, then compressed and encrypted those copies for later retrieval. Such attachment triage is consistent with intelligence requirements around policy coordination, capability planning, sanctions/enforcement discussions, and procurement or industrial cooperation topics that frequently circulate via formatted documents.

Technically, ESET highlights Cereal’s stealth characteristics: instead of relying on obvious external command-and-control infrastructure, the toolset used the victim organisation’s own Microsoft servers as part of its infrastructure, reducing detectable outbound indicators and enabling longer-term clandestine access. The firm characterises the malware as unusual for its “combination of novel techniques requiring deep knowledge of Exchange internals with unusual .NET execution methods,” a combination that should concern European network defenders responsible for government and defence-adjacent messaging systems.

The Romanian incident appears within a broader targeting pattern. ESET first observed Cereal in November 2025 against a Kazakh government agency and detected the Romanian Exchange compromise about a month later. ESET also notes Turla’s historic focus on government institutions and reports that 70% of the countries targeted by the group were post-Soviet or post-communist states in Eastern Europe and Central Asia. For Europe, the implication is that eastern flank states remain a priority collection set for Moscow, and that NATO/EU institutional correspondence is being hunted not only at central Brussels nodes but also through national-level gateways and partners’ mail infrastructure.

Romania’s exposure is also contextual: as a NATO eastern flank member, it has faced physical and digital spillover since Russia’s full-scale invasion of Ukraine, and the report cites prior hostile cyber activity affecting Romanian government and defence-industrial actors. For European defence officials and procurement leaders, the key takeaway is that email remains a primary strategic intelligence source, and Exchange compromise can produce second-order effects across alliance decision-making, industrial collaboration, and support to Ukraine—especially when attachment-focused collection can yield briefing packs, contracts, technical annexes, and meeting minutes.

Source: Derived from input