FSB-Linked Turla Compromised Romanian Government Servers to Steal NATO/EU Emails, ESET Finds
ESET's attribution rests on simultaneous use of a separately Turla-linked component and structural similarities to older Turla malware, which the firm rates high confidence.
If the Cereal toolset was deployed against Kazakhstan in November 2025 and Romania in December 2025, those are the only two confirmed cases — but the tool's design for long-dwell, in-memory execution on Exchange servers means other NATO eastern-flank governments running on-premises Exchange infrastructure should assume they are targets.
NATO's NCIRC and the national CERTs of Poland, Bulgaria, and the Baltic states are the entities that need to run the Cereal indicators against their own Exchange telemetry now, before a third case surfaces in a disclosure rather than a detection.
Romania's Microsoft Exchange servers were used as their own command-and-control infrastructure — Cereal routed no traffic to external servers, which is why the intrusion went undetected for nearly a year and why standard network-perimeter monitoring would not have caught it.
The CerealBox module specifically filtered for Word and PDF attachments in messages involving NATO and EU institutional addresses, meaning Turla was after substantive policy correspondence, not credentials. Romanian government IT teams now face a retroactive audit problem: every Exchange-hosted email touching NATO or EU counterparts from December 2025 onward must be treated as potentially exfiltrated.
Which specific Romanian government organization was compromised — a ministry, a defense agency, or a NATO liaison office — and what volume of NATO/EU-addressed correspondence passed through those servers between December 2025 and the date of discovery?
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.