ESET says it found a previously undocumented Turla toolset named Cereal on government Exchange servers in Kazakhstan and Romania, attributing the toolset to the Russia-linked group with high confidence. In Romania it was set to spot NATO and EU email traffic, and a passive backdoor takes commands via Exchange web paths rather than an external server.