Turla group used Exchange servers to spy on NATO and EU emails

Who is affected

According to ESET's research cited by Infosecurity Magazine↗ (opens in a new tab), the attack targeted at least two national government organisations: one in Kazakhstan and one in Romania. At the Romanian victim, the attackers set their tools to focus on emails sent to or from NATO and European Union addresses. ESET's telemetry suggests that around 70% of Turla's targets since 2022 have been in former Soviet republics or European states with historic ties to Russia.

How the attack worked

The Turla group used a new toolset called Cereal, which they deployed on compromised Microsoft Exchange servers. Once inside, Cereal allowed the attackers to take commands, run them directly in memory, and map the compromised organisation's network. The most notable feature was a module designed to collect emails, specifically filtering for those linked to NATO and the EU at the Romanian site.

Cereal operated without using external command-and-control (C2) servers. Instead, each hijacked Exchange server acted as its own C2 point. This made detection harder, as there was no obvious communication with outside infrastructure. The toolset received commands as separate .NET assemblies and ran its email collection module within Exchange's own processes. Payloads remained encrypted, and the attackers used advanced techniques that required a deep understanding of Exchange internals and .NET execution.

ESET did not say how the initial compromise of the Exchange servers occurred. However, they published indicators of compromise to help defenders spot similar activity.

The response

ESET published their findings on November 10, 2026, including a white paper and a GitHub repository with technical details and indicators of compromise. There is no public statement from the affected governments or Microsoft at this time. The research highlights the need for organisations using Exchange to review their systems for signs of compromise and to monitor for unusual internal activity.

What you should do

Organisations running Microsoft Exchange should check ESET's indicators of compromise and review their server logs for suspicious activity, especially any unusual .NET assemblies running in Exchange processes. Regular patching and monitoring for unauthorised access remain critical. If you handle sensitive government or diplomatic communications, extra scrutiny is warranted, given the focus on NATO and EU-related emails in this campaign.