India, Nov. 10 -- The Russian-linked cyberespionage group Turla has been using a previously undocumented malware framework to collect sensitive government correspondence from Microsoft Exchange servers. The activity, uncovered by ESET, involved government organisations in Kazakhstan and Romania and illustrates how attackers can exploit the very systems responsible for handling secure communications.

Detailed in ESET's research report published on 10 November 2026, the framework, named Cereal, operates within legitimate Exchange processes rather than relying on a conventional, externally controlled malware implant.

ESET first identified the toolkit in Kazakhstan in November 2025. A subsequent investigation uncovered another deployment at...