Romania says it stopped a Turla attack on government email
Original title: Romania says it stopped Russian cyberattack targeting government emails
SRI says a December 2025 intrusion was contained with no sensitive-data theft found; ESET links Cereal malware on Exchange.
Romania’s intelligence service said it detected a Turla intrusion against a government institution in December 2025, contained it and restored the email service. The agency attributed the operation to the Russian group linked to the FSB and said the hackers exploited vulnerabilities in Microsoft systems, without naming them or the institution. ESET reported that Turla used previously unknown Cereal malware to monitor mail and persist on Microsoft Exchange servers in Romania and Kazakhstan. In Romania, ESET said Cereal was configured to intercept mail with NATO and EU institutions.
Unconfirmed: The targeted institution and initial access method are unnamed, and the no-exfiltration finding is the agency’s statement.
- SRI said no exfiltration of sensitive data was identified.
- Cereal collects selected messages and maintains access on Exchange.
- SRI shared information with European services and NATO and EU partners.
- The agency is also investigating other possibly related Russian operations.
Impact: Attempted interception of government email with NATO and the EU
- ATT&CK
- T1114 Email Collection
- Vendors
- Microsoft
- Products
- Microsoft Exchange
- Threat actors
- Turla
- Malware
- Cereal
- Victims
- Romanian government
- Organizations
- Romanian Intelligence ServiceESETNATOEuropean Union
- Countries
- RomaniaRussiaKazakhstan
From the original article
2 min read at therecord.mediaRomania's intelligence agency said it stopped a cyber-espionage campaign by Russian state-linked hackers before the group exfiltrated sensitive data.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.