Researchers Discover Stealth Email Collection Tools in Romania and Kazakhstan
In a recent investigation, security experts have uncovered a sophisticated cyber espionage campaign orchestrated by the Russian state-sponsored group known as Turla. Researchers from the renowned security firm Eset have revealed that this group has repurposed Microsoft Exchange email servers to create infrastructure strictly under their control, enabling them to spy on communications involving significant political entities such as the North Atlantic Treaty Organization (NATO) and the European Union (EU).
The tools identified in this breach, particularly the Exchange email collection module, have been confidently linked to Turla, which operates under the mandate of Russia’s Federal Security Service (FSB). This attribution is supported by the malware components shared with publicly known frameworks associated with Turla and existing conceptual similarities with the group’s previous infrastructure, as highlighted in Eset’s findings.
The newly discovered toolset, referred to as "Cereal," is described as a collection of modular .NET malware specifically designed to operate on Microsoft Exchange servers. Its capabilities include receiving commands, executing them in memory, mapping the compromised organization, and collecting targeted email messages. According to Eset, this toolset combines unique techniques that demonstrate an in-depth understanding of Exchange internals and employs unconventional .NET execution methods. This not only reveals Turla’s technical proficiency but also underscores their strategic intent to establish a slow and meticulous long-term intrusion into the email systems of targeted organizations.
Eset’s researchers made significant strides in late 2025 when they first detected the Cereal toolset within a governmental organization in Kazakhstan. This malicious software was monitoring outgoing emails and stealthily copying messages of interest for forwarding to the attackers. The campaign soon expanded to Romania, where subsequent investigations revealed that similarly configured tools were tracking emails sent to or received from NATO and the EU.
The nature of the information being collected aligns with Russian intelligence priorities, as Eset pointed out that since 2022, a majority—approximately 70%—of Turla’s targets have been located in former Soviet republics or European countries with historical ties to the Soviet Union. This trend raises concerns about potential geopolitical motivations underlying the cyber espionage activities.
In Romania, the heightened regional tensions possibly contributed to the cyber surveillance efforts. The country recently emphasized the need for a bolstered NATO presence in response to incidents involving Russian drones intruding its airspace, resulting in crashes that injured civilians. Such escalating tensions suggest that Romania’s geopolitical stance could have made it a particular focus for Turla’s cyber espionage.
Similarly, Kazakhstan has taken steps that might indicate a shift in its political climate, as evidenced by reports of deporting Russian dissidents who had sought asylum. This includes individuals who were previously involved with opposition leader Alexei Navalny. There is speculation that Russian authorities may be looking to gather intelligence on these exiled individuals, further complicating the political landscape in the region.
Interestingly, rather than employing a straightforward backdoor method to infiltrate networks, Turla has utilized a complex chain of components for their operation. The infection process involves deploying encrypted payloads on disk, embedding .NET assemblies within other assemblies, manipulating legitimate Windows processes to load suspicious DLL files, and executing code within Exchange services that typically shouldn’t belong. Such a method illustrates the adeptness of the group in using legitimate platforms to conduct their malicious activities without detection.
One particular aspect of the operation that stands out is the lack of external command-and-control (C&C) infrastructure. Eset pointed out that instead of relying on traditional C&C servers, the compromised Exchange servers themselves act as the hub for operational activities. This means that the attackers’ infrastructure is effectively hidden, since the malicious traffic merges with legitimate services. Incoming web requests that appear to be standard traffic serve as the primary interaction point for Turla’s operators, complicating efforts to identify and dismantle their operations.
Overall, the tactics employed by Turla represent a considerable evolution in cyber espionage techniques. By using a compromised Microsoft Exchange server as the centerpiece of their operations, the group ensures their activities remain stealthy and difficult to track. Historically, Turla has targeted Microsoft Exchange servers since as early as 2014, employing various methods like the LightNeuron backdoor to execute commands that were cleverly concealed within common email attachments. The ongoing adaptation and sophistication of their strategies signal a persistent and evolving threat landscape amid increasing cyber warfare and nation-state attacks.