Russian Turla hackers attacked Romanian government institutions for NATO and EU data
The Turla espionage group, associated with the FSB, compromised a Romanian government IT system in December 2025, targeting correspondence with NATO and EU addresses.
Russian cyber espionage: Romanian servers targeted for NATO and EU correspondence
The Russian Turla espionage group compromised an IT system of a Romanian government institution on 23 December 2025, according to Gândul. The attack specifically targeted electronic correspondence exchanged with addresses associated with NATO and the European Union. A similar operation was identified in Kazakhstan on 28 November 2025.
The discoveries were published by researchers from the cybersecurity company ESET, who identified new digital espionage infrastructure linked to Turla — also known as Snake. Cybersecurity experts consider this group to be a subordinate structure of Russia's Federal Security Service (FSB).
The Cereal tool: maximum discretion, minimal traces
The hackers used a set of malicious programmes called Cereal, designed to operate on Microsoft Exchange servers — a platform widely used by governments and companies for email management. The central component of the tool, called CerealBox, monitored the flow of messages and selected correspondence according to pre-set criteria: sender, recipient, subject or the names of attached files.
The targeted messages — including those containing documents in text and PDF format — were compressed, encrypted and stored temporarily, to be retrieved later by the attack operators. Throughout this entire period, the original correspondence continued on its normal path to recipients, the institution's system functioning apparently without any anomaly.
The infiltration method is particularly difficult to detect: the programme insinuates itself into processes already active on the server, without generating alerts for network administrators. The virus executes commands directly in the server's memory, uses advanced encryption techniques and leaves very few traces in the system.
The victim's server transformed into a command centre
A distinctive feature of this operation is the absence of a classical external command and control infrastructure. Normally, programmes of this type communicate periodically with external servers to receive instructions and transmit the collected data. In this case, the hackers transformed the compromised server itself into their own operations centre, using the infrastructure of the attacked institution to carry out the espionage — a procedure that significantly complicates the identification of malicious activity and tracking of the operators.
Context: tensions in the Black Sea region
ESET researchers emphasise that the attack on Romania is relevant both in terms of the country's membership of NATO and the EU, and the security tensions in the Black Sea area.
"The case in Romania is notable because a component was configured to collect messages involving institutional addresses of NATO and the EU. This orientation corresponds to long-standing priorities of Russian intelligence services. In addition, the situation could be related to regional tensions: Romania has reported several incidents in which Russian drones have crashed near its territory, which has provoked firm reactions from the authorities," the ESET report states.
The identity of the compromised Romanian institution and the scale of the information stolen have not been publicly disclosed by the researchers.
Source: Gândul