Turla, a notorious cyberespionage group aligned with the Russian government, has been wielding a new, customizable toolset to compromise governments around the world over the past year, including Kazakhstan.

The toolset was first discovered in November 2025 by cybersecurity firm ESET, which named it “Turla’s Cereal” as a play on its highly modular, interconnected and “serialized” design. It chains and exploits different legitimate functions across Microsoft Exchange, Windows, and .NET assemblies, which Microsoft has described as “the fundamental units of deployment, version control, reuse, activation scoping, and security permissions for .NET-based applications.”

“One of the most interesting aspects of this toolset is what we did not find: external command and control infrastructure,” ESET researcher Matías Porolli wrote in the report, released Tuesday. “Instead — adding insult to injury — the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.”

Multiple Western governments and threat intelligence firms have attributed Turla as a part of Russia’s Federal Security Service (FSB), which is tasked with gathering intelligence on foreign governments, businesses and organizations. According to MITRE, the group has compromised victims in more than 50 countries, spanning governments, militaries, private-sector companies and research organizations.  

Porolli said the toolset was found on a compromised Exchange server used by the government of Kazakhstan on Nov. 28, 2025, where it could receive commands, execute in memory, gather intel on the organization and collect certain email messages.

Another version found inside a Romanian government agency a month later was configured to target emails sent to or received by the Western powers — the European Union and the North Atlantic Treaty Organization — adversarial with Russia. At the time, Romanian politicians were calling for a NATO mission in the Black Sea to deter what they viewed as Russian aggression. In July, the EU announced sanctions against Russian individuals and organizations, citing a yearslong cyberespionage campaign from Turla and other Russian groups against European nations as well as the targeting of Poland’s energy grid and European businesses by Russia-aligned hacking groups.

According to ESET, the toolset lacks many features used to identify malware, such as implants, beaconing back to command-and-control infrastructure or built-in command lists. Most executables are performed in-memory using temporary storage to avoid leaving evidence, while commands written to permanent memory are delivered via encrypted payloads.

One component, dubbed CerealNeuron, operates as the main backdoor but does not beacon back to its operator the way many pieces of malware do. Instead, it runs on the compromised server and “passively listens for incoming web requests on paths that look like ordinary Exchange traffic.” The result is an attack that leaves no domain, IP address, hosting provider or timing patterns for defenders to find and block.

“The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers — they are durable collection points, internal execution hubs, and a suitable environment for hiding sophisticated .NET tradecraft,” Porolli wrote.

The post Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments appeared first on CyberScoop.

European governments sanctioned Russian individuals and organizations Monday over what they said was a years-long campaign of cyberespionage from Turla and other Russian government-led “destructive attacks” against the bloc.

Monday’s confrontation of Moscow included action from the European Union, its individual member governments and the United Kingdom. It mostly took aim at Center 16 of Russia’s Federal Security Service (FSB) over its control of the cyber threat group known by a list of names including Turla, Secret Blizzard and Waterbug.

“Cybercriminals, self-proclaimed hacktivists and private companies linked to Russia, including actors operating under its instructions, direction or control, have also carried out, enabled and facilitated a wide range of malicious activities,” European Union High Representative Kaja Kallas said in a statement.

The EU called out Russia for the Turla campaign that dated back to 2010 in France with targeting of the government there, and has also featured activity against Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. It made special mention of blaming the FSB for last December’s attacks on Poland’s energy grid, which left half a million people without heat.

In all, the European Union sanctioned nine Russian individuals and four entities. While the EU didn’t name them, Kallas’s statement said it also included officers of Russia’s Main Intelligence Directorate of the General Staff (GRU).

The United Kingdom’s cyber sanctions, the first it’s done in coordination with the EU, featured a longer list of 24 individuals and entities. The U.K. named GRU senior leadership figures Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko for their alleged hybrid cyberattacks in conjunction with cybercriminals and recruitment of hackers across Russian universities. The U.K. also sanctioned individuals behind Lumma Stealer, the target of an international takedown last year.

“These sanctions strike at the core of the cybercriminal networks propping up the Russian state’s aggression, and the UK and EU are sending a clear message that Russia cannot hide behind its use of these proxy groups,” Foreign Secretary, Yvette Cooper, said in a news release that mentioned “destructive attacks” by Russia. “From directing criminals to targeting businesses, and striking Poland’s energy grid in the depths of winter, the Russian state is sinking to new lows in its attempts to undermine European security.”

At least two European governments, Germany and France, said they would be summoning Russia’s ambassadors in their nations over the attacks.

Also Monday, the European Union announced sanctions against the company behind Russia’s messaging app, Max, citing its use of surveillance features to clamp down on dissent. And separately, 13 nations including the United States issued a warning on Monday about Russian government hackers targeting routers to carry out critical infrastructure attacks.

Russia routinely denies allegations of responsibility for any malicious cyber activity.

The post Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ appeared first on CyberScoop.