Photo: tekkix.com
Researchers at international cybersecurity firm ESET have uncovered a new cyberespionage toolset deployed against government organizations in Kazakhstan and Romania, according to a company report.
Dubbed Cereal, the toolset enabled attackers to stealthily execute commands, map compromised networks, and exfiltrate selected emails. The malware stands out for leaving virtually no disk footprint and disguising itself as legitimate Exchange processes. It also avoids external infrastructure that could be easily detected and blocked.
According to ESET, the intrusions were detected in late 2025. In both instances, threat actors compromised Microsoft Exchange servers. At the Romanian agency, a component named CerealBox was configured to intercept emails containing NATO and European Union institutional addresses—targeting that researchers say aligns closely with Russian intelligence priorities. ESET noted that the hackers similarly hunted for NATO- and EU-related correspondence within the compromised Kazakh organization.“Somewhere in a government agency, an official sends an email to a counterpart in a multinational military alliance. [...] A piece of code quietly inspects it, deems it of interest, and sets a copy aside,” explained ESET researcher Matías Porolli, illustrating the malware’s operation.
ESET experts attribute Cereal with high confidence to the Russian threat group Turla, also known as Snake, the report states. The group has been active since at least 2004. Since 2022, roughly 70% of the countries targeted by Turla have been former Soviet republics or European states historically linked to the USSR. According to assessments by several cybersecurity experts, Turla may be linked to Russia’s Federal Security Service (FSB).
