Science & Tech · Cybersecurity · 1 hr ago
Romania says it stopped Russian-linked cyberattack on government emails
Romania’s intelligence agency says it stopped a cyberattack on a government institution in December 2025.
The agency attributed the operation to Turla, a long-running cyberespionage group linked to Russia’s Federal Security Service.
The hackers exploited vulnerabilities in Microsoft systems and targeted email traffic involving NATO and European Union institutions.
Cybersecurity firm ESET said the attackers used previously unknown malware to monitor messages and maintain access to email servers.
Romania’s agency said it found no evidence that sensitive data was taken and that the affected email service has been restored.
Romania is a member of NATO and the EU and has warned of cyberattacks and other threats linked to Russia.
The agency shared information with European and NATO partners, and Romanian authorities are investigating other potentially related operations.
Romania’s intelligence agency said it stopped a cyberattack on a government institution in December 2025.
The agency attributed the operation to Turla, a Russian-linked cyberespionage group.
The attackers targeted government email systems, and researchers said the malware was configured to identify messages exchanged with NATO and EU institutions.
Romania said it found no evidence that sensitive data had been taken and that the affected email service had been restored.
The agency did not name the targeted institution or explain how the attackers first gained access.
- Who
- Turla, a cyberespionage group linked to Russia’s FSB, was blamed for the attack.
- What
- A cyberattack targeted a Romanian government institution’s email systems. Romania said it stopped the attack and found no evidence of sensitive data exfiltration.
- When
- December 2025.
- Where
- Romania; the targeted government institution was not named.
- Why
- Not stated.
This story does not have two clearly opposing sides.
Romania’s intelligence agency said it detected and stopped the cyberattack on a government institution.
ESET disclosed that Turla had targeted government email servers in Romania and Kazakhstan, according to the Straits Times report.
Romania’s intelligence agency publicly attributed the attack to Turla and said the affected email service had been restored.
- Detection
- December 2025
- Suspected group
- Turla
- Target
- Unnamed Romanian government institution
- Email targets
- Messages exchanged with NATO and EU institutions
- Outcome
- No sensitive data exfiltration identified
- Tool
- Cereal malware, according to ESET
2 sources
What people are saying
No exfiltration of sensitive data was identified
implemented measures to counter the attack and remedy its effects