Russian state-linked hackers compromised government email servers in Romania and Kazakhstan using new malware to secretly intercept messages, including emails exchanged with NATO and European Union officials, according to research published Tuesday.

Slovak cybersecurity firm ESET attributed the campaign to Turla, a long-running Russian espionage group linked to the country's Federal Security Service (FSB).

The hackers used a previously unknown toolkit dubbed Cereal to monitor email traffic, steal specific messages and maintain access to compromised Microsoft Exchange servers without being detected.

“The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage. It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes,” ESET said.

The researchers said they first discovered the toolkit in November 2025 on a government email server in Kazakhstan and later identified it at a Romanian government organization.

In Romania, the malware was configured to collect emails exchanged with NATO and EU institutions. The attack came amid rising tensions between Russia and NATO over the war in Ukraine, including repeated incidents involving Russian drones entering or approaching Romanian territory.

In Kazakhstan, ESET said the intrusion took place amid growing scrutiny of Russian exiles and Kremlin critics living in the country. However, researchers could not determine whether the hackers were specifically seeking information about dissidents.

The campaign stands out for its unusual approach to concealing the hackers' activities, researchers said. Rather than relying on separate servers to control the malware, the attackers used the victims' own compromised Exchange servers to issue commands and manage the operation.

This allowed the hackers to operate without relying on external servers that security researchers could detect, block or shut down.

"Abusing a compromised Exchange server as a central operational hub is a rare technique, used by only a handful of APT groups," ESET said. "Turla has used variations of this approach in the past."

One component of Turla's new toolkit, called CerealBox, was embedded directly into a Microsoft Exchange service responsible for processing email traffic. It allowed the attackers to identify and capture messages of interest as they passed through the server.

According to ESET, the technique has not previously been documented in other malware families and demonstrates the attackers' detailed knowledge of Microsoft's email infrastructure.

The researchers could not determine how the attackers initially gained access to the government servers or how much information they obtained.

Also known as Secret Blizzard and Venomous Bear, Turla has operated since at least 2004 and is considered one of Russia's most established state-linked hacking groups. The group has a long history of targeting government agencies, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East.

According to ESET, roughly 70% of the countries targeted by Turla since 2022 have been former Soviet republics or European countries with historical ties to the Soviet Union.