Romania says it stopped Russian cyberattack targeting government emails

Romania's intelligence agency said it stopped a cyberattack by Russian state-linked hackers on a government institution late last year. The cyberespionage campaign was revealed earlier this week by researchers who found the group  targeted Romania in an attempt to intercept emails exchanged with NATO and European Union institutions.

The Romanian Intelligence Service (SRI) said Wednesday that it detected the intrusion in December 2025 and took steps to contain the attack and restore the affected systems. The operation was attributed to Turla, a long-running Russian cyberespionage group linked to Moscow's Federal Security Service (FSB).

According to the agency, the hackers exploited vulnerabilities in Microsoft systems but Romanian cybersecurity specialists managed to stop the attack.

"No exfiltration of sensitive data was identified," the agency said, adding that the affected email service had been restored.

The SRI did not identify the targeted government institution or provide details about how the hackers initially gained access.

The Slovak cybersecurity firm ESET said Turla used a previously unknown hacking toolkit to compromise government email servers in Romania and Kazakhstan.

The malware, dubbed Cereal, allowed attackers to secretly monitor email traffic, collect selected messages and maintain access to compromised Microsoft Exchange servers while avoiding detection.

In Romania, the malware was specifically configured to intercept emails sent to or received from NATO and EU institutions, according to ESET.

A NATO and EU member bordering Ukraine and Moldova, Romania has repeatedly warned of Russian cyberattacks and other hybrid threats. The country has also reported incidents involving Russian drones entering or approaching its airspace during Moscow's attacks on Ukraine.

The SRI said it had informed relevant Romanian authorities about the incident and shared information with European intelligence services and partners within NATO and the EU. 

Romanian authorities are also investigating other potentially related cyber operations linked to Russia, the agency said.

Turla — also known as Secret Blizzard and Venomous Bear — has operated for more than two decades and is considered one of Russia's most established cyberespionage groups. It has previously targeted government agencies, diplomatic missions and defense organizations across Europe, Central Asia and the Middle East.

In July, a cyberattack disrupted Romania's national land registry system, taking critical digital services offline in what the agency responsible for the system described as the most serious technical incident in its history.

Earlier this year, Romania's then-defense minister warned that government institutions were facing thousands of attempted cyberattacks every day, many of them suspected of originating from Russia.