Turla Malware Found on Government Exchange Servers

ESET found a previously undocumented.NET toolset, named Cereal, on a Kazakh government Exchange server on November 28th, 2025, and a Romanian government server compromised on December 23rd, 2025. The Romania implant collected emails involving NATO and EU addresses. ESET attributes the modular malware to Russia-aligned APT group Turla with high confidence.