ESET says a new Turla toolset called Cereal hid inside government Microsoft Exchange servers in Kazakhstan and Romania, used the victim’s own mail server as its command hub, and quietly copied emails tied to NATO and the EU. Here is how it works and why any business still running on-premises Exchange should pay attention.