Russia-linked Turla hackers targeted a Romanian government institution, SRI says

Attack detected in December 2025

The Romanian Intelligence Service (SRI) said on 11 November 2026 that its National Cyberint Center identified a cyberattack against a government institution in December 2025. The center carried out countermeasures and remediation. The attackers exploited several systemic vulnerabilities in Microsoft operating systems in an attempt to compromise the institution's IT infrastructure. After the center's intervention the attack was stopped and the affected email service was restored. The SRI attributes the operation to the Russian actor APT TURLA.

No evidence of stolen data

Investigators found no evidence that confidential information had been taken from the compromised systems. The SRI's statement put it this way:

“No exfiltration of sensitive data was identified, and the affected email service has been remediated.”

The agency says the relevant legal beneficiaries were informed of the incident. The case was handled in cooperation with European partners in the intelligence community, as well as with structures of the EU and NATO.

ESET's analysis of the Cereal toolset

ESET Research published its analysis on 10 November 2026. It describes a malware toolset it calls Cereal, which turns compromised Microsoft Exchange servers into command points and email collectors. The first traces were found on 28 November 2025 at a government organisation in Kazakhstan. Later, improved detection rules revealed a second attack on a Romanian government organisation with activity dating from 23 December 2025, and ESET says the attackers' activity rose on 20 January 2026. ESET does not name the Romanian organisation and could not establish how the attackers got initial access, presenting exploitation of a vulnerability only as a possibility.

A component called CerealBox was configured to pick out messages exchanged with addresses in the nato.int and europa.eu domains, along with messages carrying.doc,.docx or.pdf attachments. Selected messages could be compressed, encrypted and staged on the server for retrieval, and ESET describes commands that let operators read and delete them. ESET published no proof that messages from the Romanian case left the network, and gave no count of the messages copied. The researchers wrote:

“We found the same toolset at a government institution in Romania, compromised on 23 December 2025.”

Attribution to Turla and the FSB

ESET attributes the activity to Turla with high confidence, citing the reuse of a component previously assigned to the group and similarity to a program linked to it in a 2017 report. Turla, also known as Snake, Secret Blizzard and Waterbug, has been active for more than two decades and is widely considered part of Russia's FSB, according to ESET. The analysis does not publicly identify the people who operated the program in Romania. Turla's usual targets include governments, diplomatic missions and defence organisations, mainly in Europe, Central Asia and the Middle East. Romania has faced other pro-Russian attacks too: in May 2022 Killnet claimed attacks on Romanian airport websites, including Henri Coandă, which became inaccessible while flight safety was unaffected, as reported at the time. Those attacks were described as probably DDoS, aimed at blocking access rather than spying on correspondence.

Investigations continue

The National Cyberint Center is running complex investigations that also cover other incidents linked to cyber campaigns attributed to Russia. The SRI says it will keep working to identify and investigate any new attempts to compromise institutions in Romania. Other attacks attributed to Russia are also being analysed. ESET has published an extended list of indicators of compromise on its GitHub page.