Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian hackers used new malware to steal NATO, EU correspondence from Romanian and Kazakh government servers.
Russian state-linked hackers, identified as the Turla group, compromised government email servers in Romania and Kazakhstan using a new toolkit called Cereal. This toolkit allowed them to stealthily monitor email traffic and intercept messages, including those exchanged with NATO and EU officials, by using the compromised Exchange servers as operational hubs. ESET, the cybersecurity firm that attributed the campaign to Turla, noted the sophisticated methods used to conceal the attackers' activities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ESET?
Get an email when a new story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Russian Turla group compromised government Exchange email servers in Romania and Kazakhstan, deploying a custom toolkit called Cereal to silently monitor and intercept sensitive diplomatic correspondence with NATO and EU officials. The attackers leveraged the compromised servers as operational hubs, meaning the intrusion went undetected long enough to exfiltrate high-value communications. This incident demonstrates how advanced persistent threat actors can exploit weakly monitored, internet-facing email infrastructure to conduct long-term espionage. The sophistication of the concealment techniques highlights the critical importance of anomaly detection and rigorous monitoring on servers handling sensitive government communications.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Cereal
- malware — CerealBox