Infosecurity
Turla spies on NATO and EU emails through Exchange servers
Part of the Turla story · since 19 Sep 2025
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers. This article, 15th of 15.
Russia-linked threat group Turla has deployed a new toolset, named Cereal, on compromised government Microsoft Exchange servers, with one case configured to target emails sent to or from NATO and European Union addresses. ESET attributes high confidence to Turla (also known as Snake and Uroburos) for the toolset, which has been active since at least 2004 and is broadly viewed as tied to Russia’s FSB.
The researchers identified two national government victims—one in Kazakhstan and one in Romania—with no external command-and-control infrastructure; each compromised Exchange server was repurposed to act as the C2 channel.
Cereal operates by taking commands, executing them in memory, mapping the compromised organisation, and collecting selected messages through a newly developed Exchange email collection module. The payloads are encrypted, commands arrive as separate .NET assemblies, and the email collection module runs inside Exchange’s own processes. ESET notes the technique requires a deep understanding of Exchange internals and unusual .NET execution methods.
The Romanian victim’s focus on NATO and EU emails was observed about a month after ESET first spotted the toolset in Kazakhstan on 28 November 2025, with the broader emphasis aligning with Turla’s long‑standing regional objectives. ESET’s white paper and GitHub repository list indicators of compromise and discuss how the Exchange servers became long‑term collection points and execution hubs, concealing Turla’s activity.
How the story developed
15 articles from 9 outlets since 19 Sep. Picked up again today after 7 weeks quiet. This was the 15th report, 417 days after the first.
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers. This article, 15th of 15.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 15 articles as a listHide the list
- Fri 19 SepDay 03
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine08:56 · The Hacker News · First report
- Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions13:45 · SecurityWeek
Quiet for 2 days
Sun 21 SepDay 21- ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks18:15 · Security Affairs · Picked up again
Quiet for 34 weeks
Thu 14 MayDay 2371- Secret Blizzard’s Kazuar malware hits govts with P2P botnet15:10 · Microsoft · Picked up again
- Fri 15 MayDay 2381
- Turla’s Kazuar backdoor now powers stealthy peer to peer botnet17:50 · The Hacker News
- Sat 16 MayDay 2391
- Russian Turla Group Deploys P2P Kazuar Botnet for Stealth17:16 · Security Affairs
Quiet for 6 weeks
Thu 25 JunDay 2791- Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe15:32 · Google Cloud · Picked up again
- Fri 26 JunDay 2802
- Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine08:32 · The Hacker News
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets09:10 · SecurityWeek
Quiet for 4 days
Tue 30 JunDay 2841- STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 12 weeks
Wed 23 SepDay 3691- New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks14:38 · Infosecurity · Picked up again
Quiet for 7 weeks
Tue 10 NovDay 4173- Turla uses Cereal malware to steal emails from Exchange servers11:30 · The Hacker News · Picked up again
- AI Makes Reverse Engineering Software and Malware Easier13:30 · Dark Reading
- Turla spies on NATO and EU emails through Exchange servers15:00 · Infosecurity · This article, 15th of 15