Messages could arrive normally
An email could reach its intended recipient and still be copied in transit inside the sender’s organization. That is the significance of Cereal, a set of tools ESET described on November 10 after investigating government mail servers in Kazakhstan and Romania. In Romania, the researchers found a collection rule for correspondence with NATO and European Union institutional addresses. The finding identifies which conversations interested the operators. It does not establish an intrusion into either international organization.
How the second organization came into view
ESET dates its first discovery to November 28, 2025, on a Kazakh government Exchange server. After refining its detections, the company identified the same tools at a Romanian government organization compromised on December 23 of that year. It attributes the activity to Turla with high confidence, citing accompanying software and similarities with previously documented tools. The attribution and the two cases come from ESET’s investigation.
What a delivery record can establish
For government offices exchanging sensitive material, successful delivery usually answers a narrow operational question. In the scenario ESET documented, expected delivery and unauthorized access could coexist. An investigation scoped only to bounced mail, complaints about changed messages or access to a specific user account could miss the point at which the correspondence was exposed. The Romanian finding also leaves a separate evidentiary question for officials briefing partners. A rule identifying a correspondent shows collection intent. Establishing what actually left the organization requires evidence for the messages themselves.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
