ESET reports that Turla, a Russia-aligned state-sponsored group, deployed a previously undocumented toolset called Cereal against Microsoft Exchange servers at government entities in Kazakhstan and Romania in late 2025. The modular malware collects emails while hiding within legitimate Exchange processes and avoids external command-and-control infrastructure.