Turla: Russia-Linked Hackers Stole NATO and EU Emails From Romania Using ‘Cereal’ Malware
Slovak cybersecurity firm ESET says a hacking group it tracks as Turla, which it links with high confidence to Russia’s FSB, breached the Microsoft Exchange servers of a Romanian government institution to harvest emails tied to NATO and the European Union. ESET made the findings public on November 10, 2026.
The toolset behind the intrusion is a previously undocumented, modular .NET-based malware family the company calls “Cereal.” Instead of relying on an external command-and-control server, Cereal turns the victim’s own Exchange server into its command infrastructure — malicious traffic blends into the server’s normal mail-handling activity, making the operation far harder to flag.
A component named “CerealBox” automatically filters incoming and outgoing mail for messages tied to NATO and EU institutional addresses that carry Word or PDF attachments. Matching emails are compressed and encrypted, then staged for later retrieval by the operators — a design that lets the collection run continuously with no need for an operator to be actively present.
ESET says the Romanian servers were compromised on December 23, 2025. The firm first spotted the same toolset in Kazakhstan in November 2025 and traced the Romanian intrusion roughly a month later, meaning the breach went undetected for close to a year before being exposed.
Turla is one of the oldest groups tracked by Western researchers, active since at least 2008 and historically associated with the Snake/Uroburos espionage platform. Over more than a decade it has repeatedly targeted foreign ministries, government bodies and defense-linked institutions across Europe and Central Asia.
Romania sits on NATO’s eastern flank with a Black Sea coastline. ESET notes that roughly 70 percent of the countries Turla has targeted are former Soviet or former communist-bloc states, concentrated in Eastern Europe and Central Asia. A separate Russian cyber operation against Romanian arms manufacturers supporting Ukraine was reported in May 2025, reinforcing the pattern of repeat targeting.
ESET disclosed the findings through a blog post and press release. No statement has been issued by Romanian authorities so far, and details such as the exact agency targeted, the volume of emails stolen, and whether the intrusion is still active have not been disclosed.
The case is a reminder that any government body or defense contractor regularly corresponding with NATO or EU counterparts — regardless of country — can be targeted by the same method, since the malware specifically prioritizes attachment-carrying official correspondence rather than generic traffic.
It also underscores the role independent researchers play in surfacing intrusions that an institution’s own internal monitoring misses: the Romanian breach was live for nearly a year, undetected, before ESET’s analysis brought it to light.
Sources
- Defense News, “Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU,” Linus Höller, November 11, 2026 — view source — primary source for this report, relaying ESET’s findings and timeline.
