[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frOyW3A4zjAXSvwCJx-bCBmHIcva8z8egyjyVleJOHrU":3},{"article":4,"iocs":47,"watch_terms":54,"solutions":55,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"52d96570-8ff7-44b8-8f21-2cad4d07d17b","Russian hackers compromised government email servers to steal NATO, EU correspondence","russian-hackers-compromised-government-email-servers-to-steal-nato-eu-correspond-34a205","Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.","Russian state-linked hackers, identified as the Turla group, compromised government email servers in Romania and Kazakhstan using a new toolkit called Cereal. This toolkit allowed them to stealthily monitor email traffic and intercept messages, including those exchanged with NATO and EU officials, by using the compromised Exchange servers as operational hubs. ESET, the cybersecurity firm that attributed the campaign to Turla, noted the sophisticated methods used to conceal the attackers' activities.","Russian hackers used new malware to steal NATO, EU correspondence from Romanian and Kazakh government servers.","https:\u002F\u002Ftherecord.media\u002Frussia-hackers-espionage-romania-kazakhstan","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FEmail_55c6595c21.jpg","2026-11-10T13:00:00+00:00","2026-11-10T14:00:04.746334+00:00",8,[17,20,23,26],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":22},"ESET","vendor",{"name":24,"type":25},"Microsoft Exchange","product",{"name":27,"type":28},"email","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,51],{"type":41,"value":49,"context":50},"Cereal","Previously unknown toolkit used by Turla hackers to monitor email traffic and steal messages.",{"type":41,"value":52,"context":53},"CerealBox","Component of Turla's Cereal toolkit embedded into Microsoft Exchange services.",[21,24],{"controls":56,"vendors":138},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":87,"name":88,"problem":89,"products":90},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":116,"name":117,"problem":118,"products":119},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[120,125,133],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":121,"product_name":122,"url":123,"description":124},"darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":134,"product_name":135,"url":136,"description":137},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[139,144],{"slug":140,"name":21,"logo_path":141,"roles":142},"eset","\u002Fvendor-logos\u002Feset.png",[143],"reported_by",{"slug":79,"name":80,"logo_path":81,"roles":145},[146],"affected",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":156},"turla-hackers-silently-intercepted-natoeu-emails-via-compromised-exchange-servers","Turla Hackers Silently Intercepted NATO\u002FEU Emails via Compromised Exchange Servers","The Russian Turla group compromised government Exchange email servers in Romania and Kazakhstan, deploying a custom toolkit called Cereal to silently monitor and intercept sensitive diplomatic correspondence with NATO and EU officials. The attackers leveraged the compromised servers as operational hubs, meaning the intrusion went undetected long enough to exfiltrate high-value communications. This incident demonstrates how advanced persistent threat actors can exploit weakly monitored, internet-facing email infrastructure to conduct long-term espionage. The sophistication of the concealment techniques highlights the critical importance of anomaly detection and rigorous monitoring on servers handling sensitive government communications.",[152,153,154,155],"MITRE ATT&CK T1114: Email Collection","NIST SP 800-53 SI-4: System Monitoring","CIS Control 13: Network Monitoring and Defense (v8)","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":157,"MITRE ATT&CK T1114: Email Collection":158,"NIST SP 800-53 SI-4: System Monitoring":159,"CIS Control 13: Network Monitoring and Defense (v8)":160},"Stricter access control and asset management over the Exchange servers — including privileged account governance — would have limited the attackers' ability to install and persist with the Cereal toolkit.","Turla's Cereal toolkit was specifically designed to monitor and intercept email traffic on compromised Exchange servers, directly matching this technique.","Continuous monitoring of the Exchange servers for anomalous processes and unauthorized transport agents would have detected Cereal's stealthy interception activity earlier.","Monitoring network traffic flowing through the email servers for unusual outbound connections or data exfiltration patterns could have revealed the attackers using them as operational hubs."]