Cereal malware / Turla (Secret Blizzard): Romanian government email servers — FSB-linked espionage toolkit intercepted NATO/EU email traffic on Microsoft Exchange
Severity: high · Patch status: no-fix-needed · Since 2026-11-12
Romania's SRI said it detected and stopped a Russian state-linked cyberespionage attack on a government institution's email systems in December 2025, attributed to Turla (FSB-linked, also known as Secret Blizzard). ESET reported Turla used a previously unknown toolkit dubbed Cereal to compromise Microsoft Exchange servers in Romania and Kazakhstan, secretly monitoring email traffic and collecting messages while evading detection. In Romania the malware was configured to intercept emails exchanged with NATO and EU institutions. SRI says no sensitive data exfiltration was identified and the affected email service was restored; the targeted institution and initial access vector were not disclosed. Information was shared with NATO, EU and European partners, and related operations are under investigation.
What to do
- Hunt for Cereal indicators of compromise and Turla tooling on Exchange servers and mail infrastructure
- Review Exchange patch level and apply all Microsoft security updates; investigate unknown vulnerabilities used for initial access
- Audit mail flow rules, forwarding, and mailbox permissions for covert collection or interception configurations
- Monitor for anomalous access to email traffic involving NATO/EU or diplomatic correspondence
- Share incident intelligence with national CERT and sectoral/Alliance partners
Sources
All live incidents on Threat Watch
