Turla Uses Compromised Exchange Servers for Targeted Espionage

ESET reports Turla using its Cereal toolkit on government Exchange servers in Romania and Kazakhstan, including to collect selected correspondence involving NATO and EU institutions. Compromised servers reportedly served as command infrastructure, with components embedded in Exchange processing; initial access and the amount of data stolen remain unknown. Defenders should investigate persistence and suspicious mail-server activity.