Romania Thwarts Russian Espionage Campaign Targeting Government Emails
Romania's intelligence agency has successfully disrupted a Russian state-linked cyberespionage campaign aimed at compromising government emails and exfiltrating sensitive data.
Romania's intelligence agency, the SRI, announced it has thwarted a sophisticated cyberespionage campaign orchestrated by Russian state-linked actors targeting a government institution. The operation, detected in December 2025, was attributed to the notorious Turla group, also known as Secret Blizzard or Venomous Bear, which has long been associated with Russia's Federal Security Service (FSB).
The primary objective of the attackers was to intercept emails exchanged with key NATO and European Union institutions. Researchers from Slovak cybersecurity firm ESET, who also investigated the campaign, discovered that Turla employed a previously unknown malware toolkit, codenamed "Cereal." This malware was designed to covertly monitor email traffic, selectively collect messages, and maintain persistent access to compromised Microsoft Exchange servers while evading detection.
In the specific case of the Romanian target, the Cereal malware was meticulously configured to intercept communications directed to or originating from NATO and EU entities. This strategic targeting underscores the ongoing efforts by Russian state-sponsored groups to gather intelligence on sensitive governmental and international communications.
Fortunately, Romanian cybersecurity specialists were able to detect the intrusion and implement measures to contain the attack before any sensitive data could be exfiltrated. The SRI confirmed that the affected email service has since been restored, and no data compromise was identified. The specific government institution targeted was not disclosed by the SRI.
This incident highlights Romania's persistent vulnerability to state-sponsored cyber threats, particularly from Russia. As a NATO and EU member bordering Ukraine, the country is frequently a target for cyberattacks and other hybrid warfare tactics. Earlier in 2025, Romania's national land registry system was significantly disrupted by a cyberattack, and the country's defense minister had previously warned of thousands of daily attempted cyberattacks against government institutions.
The SRI has shared intelligence regarding this incident with relevant Romanian authorities, as well as with European intelligence services and partners within NATO and the EU. The agency indicated that investigations into other potentially related Russian cyber operations are ongoing.
Turla has been active for over two decades, establishing itself as one of Russia's most persistent and capable cyberespionage groups. Its historical targets have included government agencies, diplomatic missions, and defense organizations across Europe, Central Asia, and the Middle East, making this latest operation consistent with its established modus operandi.
The successful disruption of this campaign by Romanian authorities serves as a critical reminder of the continuous threat posed by advanced persistent threats (APTs) to governmental infrastructure and the importance of robust cybersecurity defenses and international intelligence sharing.