Turla malware infiltrates Romanian government email servers
In December 2025, a breach by Turla, a hacking group linked to Russia's FSB, was discovered in Romanian government agencies' email systems. The attackers installed the malicious tool Cereal on Exchange servers and configured it to selectively collect emails related to NATO and the EU. Romanian intelligence authorities said they had restored services and blocked the attack, and that no exfiltration of sensitive information had been confirmed.
Key facts
- Affected organization
- Being confirmed
- Incident type
- Malware
- Occurred / detected
- 2025-12
- Scale of damage
- Compromise of Romanian government agencies' email systems
- Cause / method
- Turla installed the malicious tool Cereal on Exchange servers and configured it to selectively collect emails related to NATO and the EU
- Location
- Romania
Timeline
- A case in which Turla installed the malicious tool Cereal on government agencies' Exchange servers to collect emails was disclosed.
- Romanian intelligence authorities disclosed the breach discovered in December 2025 and the restoration of services, stating that no exfiltration of sensitive information had been confirmed.
- Romanian intelligence authorities said they had blocked the cyberespionage attack before sensitive information was exfiltrated.
11 related reports
- Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers
- Turla’s Cereal malware turns victims’ Exchange servers into spy hubs
- Turla hackers use new Cereal malware to spy on govt Exchange servers
- Russian hackers compromised government email servers to steal NATO, EU correspondence
- Turla 攻击罗马尼亚政府机构，新恶意软件 Cereal 窃取北约和欧盟邮件
- Romania Foils Russian Turla Cyberattack on Government Agency
- Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU
- Romanian intelligence agency says it identified Russian-linked cyber attack
- ESET Links Cereal to Turla in Romanian Server Breach Case — Defense News
- Romania identifies Russian-linked cyberattack on government institution
- Romania says it stopped Russian cyberattack targeting government emails
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.