ESET Research published on 10 November 2026 that it found a previously undocumented modular .NET toolset, which it named Cereal, on an Exchange server of a governmental organisation in Kazakhstan on 28 November 2025, and then at a governmental organisation in Romania compromised on 23 December 2025, where it was configured to identify emails sent to or received from NATO and the European Union. ESET attributes Cereal with high confidence to the Russia-aligned APT group Turla, which it says is widely assessed to be part of Russia's FSB.

ESET says the CerealBox component is injected directly into EdgeTransport.exe, the Exchange process that handles email flow, and hijacks existing transport agents rather than registering a new one; it collects messages with .doc, .docx or .pdf attachments that match hardcoded sender, recipient, subject or attachment-name lists.

ESET says CerealNeuron is a passive backdoor that executes .NET assemblies delivered in network requests, CerealHermit is a variant that reads encrypted command files from disk, and it observed no external command-and-control infrastructure: the victim's Exchange server acts as the C&C. ESET publishes IoCs in its GitHub repository and white paper. (source: ESET WeLiveSecurity)