RomaniaRussian hackers intercepted government mail with NATO and the EU.
Researchers found the toolkit on a Kazakhstan government server in November 2025, then in Romania.
ESET says Turla, linked to Russia’s FSB, used the victims’ own Exchange servers as command hubs, leaving no external servers to block.
ESET could not determine how the attackers got in or how much they stole.
How each outlet framed it
- The Record leans critical
- names the Cereal toolkit and its evasion of Exchange processes, and the NATO and EU mail it targeted in Romania
Sources: The Record