The Turla group has used a new customizable toolset to compromise governments including Kazakhstan. ESET discovered the toolset on a compromised Exchange server used by the government of Kazakhstan in November 2025. Another version found inside a Romanian government agency targeted emails involving the European Union and NATO. The toolset lacks external command and control infrastructure, using the victim server instead. This design leaves no domain or IP address for defenders to block.
Read the full story at cyberscoop.com.
