Romania says it stopped Russian cyberattack targeting government emails
Romania's intelligence agency stopped a Russian cyberattack targeting government emails in December 2025, with hackers attempting to intercept communications with NATO and EU institutions.
The Romanian Intelligence Service (SRI) announced Wednesday that it successfully contained a cyberattack attributed to Russian state-linked hackers in December 2025. The cyberespionage campaign, revealed earlier this week by cybersecurity researchers, specifically targeted Romanian government institutions in an attempt to intercept emails exchanged with NATO and European Union bodies.
The operation was linked to Turla, a long-running Russian cyberespionage group connected to Moscow's Federal Security Service (FSB). According to the SRI, the hackers exploited vulnerabilities in Microsoft systems, but Romanian cybersecurity specialists managed to prevent any data exfiltration. No sensitive information was compromised, and the affected email service has been fully restored.
Attack details
The Slovak cybersecurity firm ESET revealed that Turla employed a previously unknown hacking toolkit called Cereal to compromise government email servers in Romania and Kazakhstan. This malware allowed attackers to secretly monitor email traffic, collect selected messages, and maintain access to compromised Microsoft Exchange servers while evading detection.
In Romania, the malware was specifically configured to intercept emails sent to or received from NATO and EU institutions.
Broader context
As a NATO and EU member bordering Ukraine and Moldova, Romania has repeatedly warned of Russian cyberattacks and hybrid threats. The country has also reported incidents involving Russian drones entering its airspace during Moscow's attacks on Ukraine. The SRI has shared information about this incident with European intelligence services and partners within NATO and the EU.
Romanian authorities are investigating other potentially related cyber operations linked to Russia. This incident follows a July cyberattack that disrupted Romania's national land registry system, described as the most serious technical incident in its history. Earlier this year, Romania's then-defense minister noted government institutions face thousands of attempted cyberattacks daily, many suspected to originate from Russia.
Related
