Turla Spies on Moscow’s Ally and NATO with Nothing to Seize

Russians celebrate New Year twice. Old New Year falls on January 14, a remnant of the Julian calendar and the last excuse some use to stretch the winter break. On January 15, 2026, activity inside the mail server of a Kazakh government organization jumped. ESET, the Slovak security company whose software ran on the server, reads the timing as the intruders returning to work.

They had been inside since at least November 28, 2025, and the government they were reading belongs to Moscow's own security and economic blocs. A month after finding them there, ESET found the same toolset on the mail server of a Romanian government organization, quietly copying correspondence with nato.int and europa.eu addresses whenever it carried a Word file or a PDF.

ESET published the toolset on November 10 as Turla's Cereal and attributes it with high confidence to VENOMOUS BEAR (aka Turla), the adversary CrowdStrike assesses with high confidence to be part of Russia's Federal Security Service (FSB). Both victims ran Microsoft Exchange, and in both cases the toolset turned the victim's own mail server into the place where Russian intelligence issued commands and collected what it took.

The pairing is the story. Western governments fight Russian cyber espionage fastest with takedowns and blocklists, and both need adversary infrastructure to aim at. Cereal has none. The victim list shows the FSB collecting on a NATO member's dialogue with the alliance and on a treaty partner hedging between Moscow and the West, with the same toolset and the same patience. I assess with moderate confidence the Kazakh compromise reveals more about Russian intelligence priorities than the Romanian one does.

Spying on the Ally

Kazakhstan is a treaty partner, a member of the Collective Security Treaty Organization and the Eurasian Economic Union. Its mail server hosted Cereal for at least seven weeks before the Old New Year surge, and possibly far longer. Pattern-of-life evidence like a holiday rhythm is soft, but it points the same way as the code, toward people keeping a Russian calendar.

ESET raises one hypothesis involving Russian exiles. Since January 2026, Kazakhstan has begun deporting Russians who fled the war. IT specialist Alexander Kachkurkin was deported in late January over jaywalking and indoor hookah violations and arrested for treason on arrival in Russia. In March, the rights group Slovo Zashchite warned of mass deportations in a case run by Kazakhstan's National Security Committee (KNB). ESET suggests the FSB wanted visibility into dissidents known to Kazakh authorities but not yet slated for removal.

The hypothesis has a weakness. Kachkurkin's lawyer, Yevgeny Smirnov, says Astana acted "at the unofficial request of the FSB," with no formal extradition request. If the KNB already acts on such requests, the FSB has less need to hack a Kazakh ministry for what the ministry will share. Intrusion makes the most sense for what a partner withholds. Carnegie's Temur Umarov attributes the deportations to fading Western pressure and reciprocity. I assess with low confidence exile surveillance was the primary objective, though it could be one requirement among several.

Kazakhstan withholds plenty. President Kassym-Jomart Tokayev keeps open lines to Europe, the United States, and China. In late July, standing next to Vladimir Putin in Omsk, he urged a freeze of the war along the current front, called it a "war" between two independent states, and said he had received "signals" from Europe and the US. About 80 percent of Kazakh oil leaves through the Caspian Pipeline Consortium, whose shareholders include American, British, German, and Italian companies.

Money and energy sit at the center as well. Kazakhstan chose a Rosatom-led consortium for its first nuclear plant in June 2025, over Chinese, French, and Korean bids, and the agreement signed in May 2026 expects Russia to finance 85 percent. Astana's negotiating positions, Western contacts, and sanctions commitments are what a partner keeps from its patron. I assess with moderate confidence the Kazakh intrusion served collection on Astana's foreign and economic policy, including its dealings with the West.

There is a mirror image. I examined Silent Lynx, which overlaps activity Cisco Talos tracks as UAT-6275 and Recorded Future tracks as TAG-193. Cisco assesses with moderate confidence the activity has a Kazakhstan nexus. Reuters reported the researchers found evidence of access to Nizhny Novgorod's government network.

The FSB is first a counter-intelligence service, and the CIS is its home ground. A Kazakhstan-nexus espionage operation collecting on Russia and its neighbors would create an obvious counter-intelligence requirement. Access to a Kazakh government mail system could expose what Astana's services know and who receives their reporting. ESET does not identify the victim or connect it to intelligence work. I hold this explanation at low confidence.

One detail deserves attention. The earliest sample of Cereal's loader ESET found was uploaded to VirusTotal from Kazakhstan on May 11, 2022, two weeks after it was compiled. Someone in Kazakhstan held a copy three and a half years before ESET's discovery. That someone could be an earlier victim, a defender, or a tester, and submission geography is weak evidence, as the Silent Lynx attribution showed. If it marks an earlier victim, the FSB's presence inside the Kazakh state predates the deportation campaign ESET uses to explain it.

Reading NATO Through Bucharest

Romania is the expected target. Beyond the nato.int and europa.eu domains, the Romanian configuration of CerealBox, the component reading the mail, named a small number of individuals connected to government work involving both institutions. The compromise dates from at least December 23, 2025, with activity rising on January 20, 2026. CerealBox stops on its own 70 days after its first run, and ESET does not say when that run began, so the collection window can only be bounded, not dated.

The surrounding calendar is dense. In February, Defense Minister Radu Miruță used the Munich Security Conference to call for a NATO Black Sea Sentry mission, modeled on the alliance's Baltic and Eastern Sentry operations. Russian drones kept crossing into Romanian airspace, and in late July Romania shot down three in three days and expelled a Russian diplomat. The Commission's investigation into TikTok over Romania's annulled 2024 presidential election remained open in January.

Each thread is an obvious Russian intelligence requirement. A Black Sea mission would put alliance sensors and air defenses on Russia's southern maritime flank. Romania's rules of engagement for drones determine how far Moscow can push before an ally fires. An EU investigation into election interference concerns an operation the Kremlin denies conducting. I assess with high confidence the intrusion served collection on Romania's dealings with NATO and the EU, though which decisions the FSB wanted to anticipate remains unknown.

The targeting reflects a sound collection judgment. NATO's classified networks are hard targets. Drafts, national position papers, and meeting readouts travel through member governments' ordinary unclassified mail long before an alliance decision takes shape. I made the same argument when the GRU's FANCY BEAR breached a NATO naval shipbuilder rather than a navy, and when China-aligned TA419 phished AI policy experts to get inside the decision loop. A national mail server is the alliance's soft seam.

Romania already knew it was a VENOMOUS BEAR target. On July 13, the day the EU and UK announced sanctions, the foreign ministry stated "Romania has also been targeted by hostile cyber activities carried out by APT TURLA," and the North Atlantic Council issued its own condemnation. President Nicușor Dan said the same day the FSB's operations had reached Romania. Neither statement identified the affected institution, and ESET notes another Romanian government case in its telemetry, so whether Bucharest's acknowledgment covers the Cereal intrusion is unknown.

Breakfast Inside the Mail Server

ESET named the family for its heavy use of serialization, packaging code and data into objects for transport. Matías Porolli, who wrote the technical white paper, describes eight components. Only one, CerealLoader, ever touches disk as a recognizable .NET file. Everything else arrives encrypted, unpacks in memory, and runs there.

The backdoor at the center, CerealNeuron, never calls home. It registers web listeners on the Exchange server for paths built to resemble ordinary Exchange traffic, including /owa/sdds/, /autodiscover/proxyservice/, and /microsoft-server-activesync/integrated/api/. A request carrying a valid RSA and AES envelope and a passing HMAC check gets decrypted and executed. Anything else gets redirected to a legitimate Exchange error page. A sibling, CerealHermit, strips the network code out and reads encrypted command files from disk instead, giving VENOMOUS BEAR a second way in.

Commands arrive as disposable programs. Each task, whether pulling a mailbox through Exchange Web Services, querying Active Directory over LDAP, running WMI queries, listing volume snapshots, or extracting LSA secrets from the registry, ships as its own compiled .NET assembly wrapped in a container ESET calls CerealRunner. ESET recovered thousands of CerealRunner binaries across the two intrusions. Near-identical binaries in such volume point to an internal framework compiling and packaging commands automatically, the signature of an engineering organization rather than a lone hacker.

The execution tricks live in rarely used corners of the .NET specification. CerealLoader runs native code before any .NET code, using a feature called VTable Fixups to bridge into a method nothing else in the program calls, so a decompiler shows code doing nothing. VENOMOUS BEAR planted copies in the Windows Management Instrumentation folder under the names ncobjapi.dll and wbemcomn.dll, where a legitimate WMI process loads them. Other copies sat in the .NET native image cache under Exchange library names, so Exchange loaded the malicious file while asking for its own code.

CerealBox is the novel part. VENOMOUS BEAR's earlier LightNeuron registered itself as an Exchange transport agent, which leaves a trace in Exchange's configuration. CerealBox is injected into EdgeTransport.exe instead, wraps the routing agents already loaded in memory, runs its own filter first, then hands each message back. No new agent appears anywhere. ESET calls the technique undocumented in any malware family and says it demands deep knowledge of Exchange's transport pipeline.

The filter reveals the requirement. A message qualifies only with a .doc, .docx, or .pdf attachment and a match against hardcoded lists of senders, recipients, subject strings, or attachment names. CerealBox is built to collect finished staff work, position papers, drafts, and minutes, rather than the conversation around them. The LSA secrets command adds a second prize, domain and local account credentials good for access long after anyone finds the Exchange implant.

The filter is also a requirements document. Every change meant compiling and delivering a new binary, so each recovered version preserves the subjects and people Russian intelligence wanted to read. ESET withheld the lists because they identify the victims. Correlating the binaries with deployment telemetry could give the affected governments a time-bounded record of FSB collection priorities and show NATO which conversations Moscow valued during the campaign.

Infrastructure Nobody Can Seize

VENOMOUS BEAR has spent more than a decade using other people's infrastructure. In 2015, Kaspersky documented VENOMOUS BEAR hijacking satellite internet links to hide its command-and-control servers. In 2019, the NSA and the UK's National Cyber Security Centre reported VENOMOUS BEAR taking over Iranian tools and infrastructure to run its own operations. In 2024, Microsoft described VENOMOUS BEAR, which it tracks as Secret Blizzard, hijacking a Pakistan-based threat actor's infrastructure to reach Afghan government targets and to collect Indian military data the Pakistani operation had already stolen.

Cereal takes the habit to its logical end. The victim's own internet-facing Exchange server is the command-and-control point. ESET found no external infrastructure and could not identify the addresses VENOMOUS BEAR used to reach CerealNeuron, so it cannot say whether the intruders connected directly, through anonymization services, or through other compromised hosts. A defender reading firewall logs sees requests to Outlook Web Access, Autodiscover, and ActiveSync, the traffic an Exchange server exists to accept.

Whether by intent or evolution, the design blunts two of the West's fastest technical responses. In May 2023, Operation MEDUSA disabled Snake by reaching its peer-to-peer network. Blocklists depend on reusable domains or addresses. Cereal offers neither. The EU and UK can still impose political and financial costs on people and entities. Their July package identified FSB Center 16 as controlling Turla, but it cannot remove an implant whose control point belongs to the victim.

The same logic runs through VENOMOUS BEAR's other 2026 tooling. Google's June analysis of STOCKSTAY, a backdoor aimed heavily at Ukrainian government and military targets, found it hiding command traffic on legitimate hosting platforms such as Render and Glitch. Where VENOMOUS BEAR needs outbound communication, it borrows a platform defenders cannot block. Where it sits on an Exchange server, it needs no outbound communication at all. I examined the limits of infrastructure seizure when KillSec's takedown left its business model intact, and Cereal applies the same lesson at the level of a state service.

Sanctions also send a message about what the West will not tolerate, and Moscow's answer would rest on precedent. Russia denies responsibility for malicious cyber activity, and passive collection against foreign governments is what intelligence services do, allies included. Danish broadcaster DR reported in 2021 the NSA used Danish cables to spy on Angela Merkel and other European officials. Cereal destroyed nothing and disrupted nothing.

Bucharest sees it differently. Romania's foreign ministry places VENOMOUS BEAR inside a hybrid campaign aimed at "testing the unity and cohesion" of NATO and the EU, which treats reading allied mail as an attack on the alliance itself rather than routine statecraft. Both readings describe the same intrusion.

The Kremlin's argument has force, and it exposes a weakness in the Western response. The July package bundled VENOMOUS BEAR's espionage with the FSB's attempted sabotage of Poland's power grid, the kind of destructive operation I examined when VOODOO BEAR wiped a Ukrainian grain firm. Treating collection and sabotage as one offense blurs the line deterrence depends on, and I assess with moderate confidence it leaves Moscow little reason to restrain the more dangerous of the two.

Attribution and Visibility

ESET's attribution rests on two pillars, a bootstrapper first documented by Palo Alto Networks in VENOMOUS BEAR's IronNetInjector and conceptual similarity to Neuron, which the NCSC attributed to VENOMOUS BEAR in 2017. VENOMOUS BEAR's own history of stealing Iranian tools shows code can travel between actors, and ESET says so. Since 2025, ESET has also documented VENOMOUS BEAR cooperating with PRIMITIVE BEAR (aka Gamaredon), another FSB-linked adversary, which blurs the edges between FSB teams.

None of this undermines the core judgment. A bootstrapper recompiled on October 3, 2025, running beside new components across two victims, is not a borrowed tool. The attribution to the FSB looks solid. The attribution to a specific team inside it is the softer layer, the kind of question I examined in Attribution Is a Confidence Game and in DarkBlinders and the hall of mirrors of threat actor naming.

The victim count deserves the same skepticism. ESET found two victims because ESET products were running on those Exchange servers. Its figure of about 70 percent of VENOMOUS BEAR's targeted countries since 2022 being former Soviet republics or once Soviet-aligned European states comes from the same telemetry, and a vendor's telemetry reflects where its products run. The two victims are a floor. Governments running other security products, or none on their mail servers, would not appear in this count.

Detection itself depended on knowing what to look for. ESET found the Romanian victim only after tuning its detections on the Kazakh samples, and the 2022 loader sample sat on VirusTotal for three and a half years before anyone publicly tied it to Turla. Vendors without those signatures, and governments without host telemetry on Exchange, could be hosting Cereal today.

Sovereign Mail and Foreign Readers

Both victims ran their own Exchange servers. Governments keep mail on-premises for defensible reasons, chiefly control over where official correspondence lives and which foreign provider can be compelled to hand it over. Cereal shows the cost. An on-premises Exchange server gives a capable adversary a .NET runtime, the transport pipeline, and a public web front end it can turn into a command channel, inside a system its owner rarely instruments the way it instruments workstations.

Microsoft ended standard support for Exchange 2016 and 2019 on October 14, 2025. A paid security update program covered enrolled servers through April 2026, followed by a separately purchased second period through October. Microsoft released the final updates on October 13. ESET could not determine the initial access method or identify either victim's Exchange version. The public evidence cannot show whether unsupported software, delayed patching, or an unknown weakness enabled entry.

Sovereignty claims also deserve the scrutiny I applied when Nihon Cyber Defence marketed sovereignty as a label. Keeping the mail server in a national building keeps it away from foreign subpoenas. It does nothing about a foreign intelligence service already inside the server, and Cereal keeps its loot on the victim's own disk until the threat actor collects it through the front door.

The detection lesson follows. Network monitoring sees Exchange traffic going to Exchange. ESET found Cereal through endpoint telemetry on the servers themselves, the kind of telemetry many organizations deploy on laptops long before mail servers. Government security teams need host-level visibility on Exchange, and they need to treat any confirmed Exchange compromise as a credential compromise, because Cereal's LSA secrets command hands the threat actor domain accounts the implant no longer needs.

Hunting Cereal

Indicators matter less than behaviors here, because ESET found no network infrastructure, and the hashes it published for 18 files, kept in its GitHub repository, will change. The Analyst Annex lists a capped subset. Defenders running on-premises Exchange should look for files in the .NET native image cache, under directories such as NativeImages_v4.0.30319_64, which Ngen did not generate, especially files named after Exchange libraries. They should check the WMI folder for unexpected copies of ncobjapi.dll and wbemcomn.dll, whose legitimate versions sit in System32 rather than System32\wbem.

On the Exchange side, a web listener registered by anything other than Exchange's own services, answering on Outlook Web Access, Autodiscover, or ActiveSync paths, warrants immediate investigation. So does any module loaded into EdgeTransport.exe from outside Exchange's install path, and encrypted blobs accumulating in unusual locations on the transport server. Each of these is a proposed hunt, not a validated detection, and each needs testing against a clean baseline before it alerts anyone.

CerealSprinter also sets AMSI's amsiInitFailed variable to true before loading managed code, a bypass documented in ESET's technical analysis. That removes another layer of inspection from the in-memory chain and makes a clean content scan weak reassurance. Defenders should correlate remote-thread creation, unexpected CLR loading in WMI Provider Host, and nonstandard modules inside Exchange processes. Memory telemetry carries more value here than signatures alone.

Preservation comes before cleanup. Responders should capture memory, HTTP.sys URL registrations, Exchange transport logs, edge proxy logs, and authentication records before rebuilding a suspect server, because CerealNeuron's listener and most of the toolset live only in memory. Encrypted files on a transport server rolling over near 5 MB match CerealBox's staging pattern.

Response has to assume more than mail is gone. Organizations finding Cereal should treat every credential stored on or reachable from the Exchange server as compromised, rotate domain accounts and service accounts together, and review what the CerealRunner commands could have mapped through Active Directory. CerealBox's 70-day limit means a later sweep can find the collector inactive and the stolen files already deleted, so searches should reach back past any single window, and the absence of a running implant proves nothing about earlier collection.

The intruders came back from Old New Year to a partner government's mail, and in Bucharest a filter kept waiting for the next document bound for Brussels. Both governments kept their mail at home to keep foreigners away from it. Both were read from the inside by the same service, on the same schedule, through servers they owned.

The West can name the unit, impose sanctions, and condemn the campaign, and in July it did all three. None of that removes an implant living inside a ministry's own Exchange server. Moscow reads its partners with the same patience it applies to its adversaries, and that reach ends only when governments search their own systems for the foreign service already inside them.

Analyst Annex

Evidence status as of November 12, 2026.

Intelligence Gaps

Entities

MITRE ATT&CK Mapping

ESET built its mapping on ATT&CK version 20. Its table uses the Stealth tactic introduced when ATT&CK version 19 divided the former Defense Evasion tactic into Stealth and Defense Impairment. The rows below carry ESET's full table, mark its two Valid Accounts mappings as Provisional, and add one Defense Impairment mapping for the AMSI bypass.

Indicators

ESET found no external network infrastructure. The URL prefixes sit on the victims' own Exchange servers and matter only as host-level findings, such as an unexpected HTTP.sys registration. EdgeTransport.exe and WmiPrvSE.exe are legitimate Exchange and Windows processes and appear in this annex only as context. The list below is capped. ESET's white paper and GitHub repository hold all 18 file hashes.

Related Activity

Earlier VENOMOUS BEAR tools and operations, documented by ESET, the NCSC, Palo Alto Networks, CISA, Microsoft, and Google, were not observed in the Cereal intrusions. They establish the lineage behind ESET's attribution and the habits Cereal extends.