Key facts
- SRI attributed the December 2025 cyberattack on a Romanian government organization to the Russian-linked APT group Turla.
- SRI said attackers exploited systemic vulnerabilities in Microsoft operating systems and the attack was stopped after the National Cyberint Centre intervened.
- SRI said no exfiltration of sensitive data was identified and the affected email service has been fixed.
- ESET said Turla used previously undocumented malware designed to identify emails sent or received from NATO and the EU.
- SRI said it cooperated with EU and NATO partners in the case and did not name the targeted organization.
Romania's intelligence agency SRI said a hacking group linked to Russia's FSB security service staged a cyberattack on a Romanian government organization in December 2025, according to a Reuters report published November 11, 2026.
SRI attributed the attack to the Russian-linked APT hacking group Turla. It said it had "implemented measures to counter the attack and remedy its effects." The agency said the attackers exploited "a series of systemic vulnerabilities in Microsoft operating systems" and that the attack was stopped after the National Cyberint Centre intervened.
"No exfiltration of sensitive data was identified, and the affected email service has been fixed," SRI said, without identifying the government organization that was targeted. SRI said it had cooperated with EU and NATO partners in the case.
Cybersecurity firm ESET said on Tuesday that Turla had targeted the unnamed Romanian state institution using previously undocumented malware designed to identify emails sent or received from NATO and the EU.
Russia's embassy in Romania did not immediately respond to a request for comment. Romania, a European Union and NATO member, shares a land border of more than 600 km (370 miles) with Ukraine. Centrist President Nicusor Dan has said Romania is the target of a hybrid war waged by Russia to destabilize nations that support Kyiv, citing drone incursions into Romanian airspace, cyberattacks, disinformation campaigns, acts of sabotage and attacks on cargo vessels near Romanian waters. Russia has repeatedly denied accusations that it is waging hybrid war against European states.