The Russian-linked cyberespionage group Turla has been using a novel and customizable toolset known as 'Cereal' to infiltrate and steal government email communications. This toolset was first identified by cybersecurity firm ESET in November 2025. It exploits Microsoft Exchange, Windows, and .NET assemblies by chaining legitimate functions together, allowing it to operate without a traditional external command and control infrastructure. Instead, the compromised Exchange server is repurposed to function as the control center for these operations. Multiple Western governments and threat intelligence organizations have linked Turla to Russia's Federal Security Service. Turla is known for targeting government and private-sector entities across more than 50 countries. The Cereal toolset was initially detected on a compromised Exchange server utilized by the government of Kazakhstan. It was capable of executing commands, gathering intelligence, and collecting specific email messages directly from the server. A subsequent version was found within a Romanian government agency, configured to intercept emails involving Western entities such as the European Union and NATO, both of which have adversarial relationships with Russia. This discovery coincided with Romanian calls for NATO intervention in the Black Sea, as well as EU sanctions against Russian individuals and organizations for cyberespionage activities. ESET's analysis reveals that Cereal lacks typical malware features such as implants, overt command lists, or beaconing capabilities. Instead, it leverages in-memory execution and encrypted payloads to minimize its footprint. A key component, CerealNeuron, operates as a backdoor on the compromised server, passively monitoring web requests that mimic normal Exchange traffic. This stealthy approach makes detection challenging, as it leaves no obvious traces like domain names or IP addresses for defenders to track. ESET researcher Matías Porolli highlights that Exchange servers are not merely mail servers for Turla; they serve as durable collection points and execution hubs to conceal advanced .NET tradecraft.