A malicious program capable of covertly intercepting official correspondence has been found on the mail server of one of Kazakhstan's government agencies. Experts have linked the attack to the hacker group Turla, which is believed to be connected to Russian intelligence services.
HOW THE CYBERATTACK WAS DISCOVERED
According to NewTimes.kz, citing the international cybersecurity company ESET, the malicious program was discovered on 28 November 2025 on the Microsoft Exchange mail server of one of Kazakhstan's government agencies.
Analysis showed that the suspicious components were part of a previously unknown cyber-espionage toolkit called Cereal. The program allowed the organisation's internal network to be explored, commands to be executed and emails to be collected.
The researchers did not disclose the name of the affected agency.
HOW THE HACKERS GAINED ACCESS TO CORRESPONDENCE
The distinguishing feature of Cereal is its ability to intercept emails directly as they are being sent. The program checked the contents of messages and could save copies of them for the attackers.
At the same time, the correspondence continued as normal, so employees may not have noticed the interference.
The malicious program also made it possible to select emails by sender and recipient addresses, message subjects and attachment names.
To control the attack, the attackers used the compromised mail server itself, disguising commands as ordinary network traffic. This made the foreign activity harder to detect.
A SIMILAR PROGRAM WAS FOUND IN ROMANIA
After Cereal was discovered in Kazakhstan, ESET specialists refined their threat-detection tools. A similar program was later found at a Romanian government organisation, which was attacked on 23 December 2025.
There, the malware was configured to search for emails relating to NATO and the European Union (EU). The attackers were interested in correspondence from specific senders and recipients, including messages containing documents.
It is unknown which emails may have been the target of the attack in Kazakhstan and how much information the attackers obtained.
WHY EXPERTS LINK THE ATTACK TO RUSSIA'S FSB
ESET specialists link the program with a high degree of confidence to the Turla group, also known as Snake.
According to the researchers, the group has been active since at least 2004. It is linked to Russia's Federal Security Service (FSB).
Turla's main targets are government institutions, diplomatic missions and defence organisations in Europe, Central Asia and the Middle East.
The experts established the link to the group through the technical similarity between Cereal and previously studied Turla tools. The researchers believe the program is designed for long-term covert surveillance and information gathering.
WHAT IS KNOWN ABOUT PREVIOUS ATTACKS ON KAZAKHSTAN'S GOVERNMENT AGENCIES
In December 2025, the Computer Emergency Response Team of Kazakhstan (CERT-KZ) reported the hacking of several government agencies in Kazakhstan.
According to the specialists, the attackers maintained access to the agencies' internal systems, including Microsoft Exchange mail servers, for at least six months. They could obtain official correspondence, documents and credentials for logging into information systems.
In March 2026, the Ministry of Artificial Intelligence and Digital Development stated that the government agencies were aware of these incidents. However, the ministry did not confirm a large-scale data leak.
It is not known whether the incidents reported by CERT-KZ are connected to the cyberattack investigated by ESET.
