Technology & Cybersecurity | 12th November 2026
Romania's intelligence service has attributed a cyberattack against a government organisation to Turla, a hacking group linked to Russia's Federal Security Service (FSB).
The Romanian Intelligence Service (SRI) confirmed the findings on 11th November, following an investigation into an intrusion discovered in December 2025.
The attackers targeted a Microsoft Exchange email system using previously undocumented malware designed to identify correspondence involving NATO and European Union institutions.
Cybersecurity company ESET identified a sophisticated malware toolkit known as Cereal, which could operate within compromised email servers while attempting to avoid detection.
Researchers discovered the malware in government organisations in Romania and Kazakhstan.
ESET attributed the activity to Turla with high confidence. The group has previously been associated with Russian intelligence operations.
Romanian intelligence officials said the attack was stopped following intervention by the National Cyberint Centre.
The affected email service was restored, and authorities reported finding no evidence that sensitive data had been extracted.
The investigation involved cooperation with European Union and NATO partners.
Add comment
Comments