THE CRUNCH
Romania's intelligence agency says it stopped a cyberattack by Russian state-linked hackers on a government email system late last year. The Romanian Intelligence Service (SRI) said it detected the intrusion in December 2025, contained it and restored the affected email service, adding that "no exfiltration of sensitive data was identified". The operation was attributed to Turla, a long-running Russian cyberespionage group linked to Moscow's Federal Security Service (FSB).
The campaign came to light earlier this week when researchers at the Slovak cybersecurity firm ESET described a previously unknown toolkit, dubbed Cereal, used to compromise government email servers in Romania and Kazakhstan. The malware let attackers quietly monitor email traffic, collect selected messages and keep access to Microsoft Exchange servers while evading detection. In Romania, ESET said, it was specifically configured to intercept emails sent to or received from NATO and EU institutions.
The SRI did not name the targeted institution or explain how the hackers got in, saying only that they exploited vulnerabilities in Microsoft systems. It said it had briefed Romanian authorities and shared information with European intelligence services and NATO and EU partners, and that it is investigating other potentially related Russian cyber operations.
The incident fits a pattern. In July, a cyberattack disrupted Romania's national land registry system in what the agency running it called the most serious technical incident in its history, and earlier this year the country's then-defence minister said government institutions faced thousands of attempted cyberattacks daily, many suspected of coming from Russia.