GoKawiilTurla's new Cereal malware targets Exchange servers at NATO-linked agencies
ESET researchers say the Russian state-backed hacking group Turla deployed a new .NET-based toolset called Cereal to intercept emails from Microsoft Exchange servers at government organizations, first spotted in Kazakhstan and later at a Romanian government agency compromised on December 23, 2025. The malware, including a component called CerealBox, injects into Exchange's mail-processing process to covertly read messages containing document attachments and correspondence tied to NATO and EU officials without disrupting normal mail flow.