Security firm ESET said it found a new set of malware, which it calls Cereal, on Microsoft Exchange email servers at two government bodies. It first saw the tools in Kazakhstan on November 28, 2025. It later found them in Romania, where the break-in dated to December 23, 2025. ESET said, with high confidence, that Turla built them. ESET describes Turla, also called Snake, as a Russia-aligned group active since at least 2004. The Hacker News reported the findings ahead of ESET's publication.
ESET said the Romanian copy was set up to pick out email sent to or from NATO and the European Union. One part, CerealBox, hooks into Exchange's mail flow and saves copies of messages with .doc, .docx or .pdf attachments that match its lists. Operators later pull those copies out. ESET said the malware has no outside control server; it waits for requests that look like normal Exchange traffic. ESET could not identify the addresses the operators used. The Hacker News reported that how the attackers first got in is unknown.
Many organisations run their own Exchange servers and face the internet with them. ESET says this malware hides inside that normal traffic, so blocking suspicious outside addresses would not catch it. ESET published indicators of compromise, meaning file and system clues that show an infection, in its white paper and on GitHub.