Russian Espionage Tool Targets NATO and EU Emails in Romania
ESET has uncovered a Russian-linked espionage toolkit targeting NATO and EU correspondence through compromised Romanian government email servers, raising new concerns about intelligence security.
A newly discovered cyberespionage toolkit attributed to Russia's FSB-linked Turla group compromised government email servers in Romania and Kazakhstan, exposing communications involving NATO and EU institutions.
A sophisticated Russian-linked cyberespionage operation has targeted government email infrastructure in Romania, using previously undocumented malware to intercept communications involving NATO and European Union institutions, according to research published by Slovak cybersecurity company ESET on November 10.
The operation involved a modular malware toolkit named Cereal, which researchers attributed with high confidence to Turla, a long-established Russian cyberespionage group widely assessed to be associated with the Federal Security Service (FSB).
ESET identified the toolkit at two government organizations, one in Kazakhstan and another in Romania. The Romanian organization was compromised on December 23, 2025, with malware configured to identify correspondence sent to or received from NATO and EU institutional addresses.
How the Espionage Operation Worked
Unlike conventional malware that communicates with external command-and-control servers, Cereal used the victim's own Microsoft Exchange infrastructure to maintain access and execute commands.
One component, known as CerealBox, was injected directly into the Exchange email transport process. It intercepted selected messages while allowing legitimate communications to continue operating normally.
The malware could identify messages containing Microsoft Word or PDF attachments and matching specified email addresses, subjects or file names. Selected messages were compressed, encrypted and staged for subsequent extraction.
According to ESET, the operation combined sophisticated .NET execution techniques, encrypted payloads and in-memory execution to minimize detectable activity.
The absence of dedicated external command infrastructure made the operation particularly difficult to identify through conventional network monitoring.
Why Romania Matters to NATO Intelligence
Romania occupies a strategically important position on NATO's eastern flank, particularly because of its Black Sea coastline, military infrastructure and role in supporting Ukraine.
Intelligence concerning regional military movements, alliance coordination and security policy represents a potentially valuable target for Russian intelligence services.
ESET did not identify the compromised Romanian institution publicly, nor did it establish the full volume or sensitivity of the information obtained.
The findings also do not indicate that NATO or EU institutional networks were themselves compromised. The confirmed intrusion involved government organizations communicating with those institutions.
The discovery adds to broader concerns about Russian cyber operations targeting European government infrastructure. AdriaDefense previously reported on Russian-linked cyber campaigns affecting European institutions.
Implications for Europe's Defense Industry
Although ESET has not identified defense contractors as victims of this particular operation, the techniques uncovered have implications for the European defense industrial ecosystem.
Defense procurement frequently involves sensitive exchanges between government authorities, military organizations, manufacturers and technology suppliers. Communications may contain details about acquisition priorities, technical requirements, delivery schedules and procurement negotiations.
An attacker able to monitor government correspondence could potentially gain valuable intelligence about military modernization programs without directly compromising the manufacturers involved.
The case illustrates why protecting government communication infrastructure has become an important component of defense industrial security, alongside physical protection, supply-chain security and counterintelligence.
For cybersecurity suppliers, it also highlights demand for advanced threat detection capable of identifying malicious activity embedded within legitimate enterprise software.
ESET's findings were published in a technical investigation by researcher Matías Porolli, titled Exchange for Breakfast: Turla's Cereal Tricks Are Not for Kids.
Source: ESET Research, November 10, 2026
