Russia-linked hackers spied on Romanian agency's Nato and EU emails

Russia-linked hackers compromised the email server of a Romanian government institution to intercept correspondence with Nato and the European Union, cybersecurity firm ESET said in research published on Tuesday. Romania's intelligence service, SRI, confirmed the attack had taken place and said it had been contained.

ESET attributed the campaign to Turla, a hacking group it says is widely considered part of Russia's FSB security service, also known under the names Snake and Secret Blizzard. The group installed malware called CerealBox on the Romanian institution's Microsoft Exchange server, configured to search for messages exchanged with addresses on the nato.int and europa.eu domains, according to ESET's analysis.

SRI said its National Cyberint Centre first identified the attack in December 2025 and had since implemented countermeasures and remediated its effects. The attackers exploited "systemic vulnerabilities" in Microsoft operating systems, but no sensitive data was found to have been exfiltrated, and the affected email service has been fixed, SRI said. The agency said it had informed European and Nato intelligence partners.

ESET said the malware, which could read and delete selected messages without leaving traces, targeted emails with attachments such as .doc, .docx or .pdf files that matched criteria including sender, recipient and subject line. Researchers said the Romanian institution's server had been compromised since at least 23 December 2025, and that the same toolset had been found a month earlier at a government body in Kazakhstan.

Turla has been active for more than two decades and has previously targeted governments, diplomatic missions and defence organisations mainly in Europe, Central Asia and the Middle East, ESET said. SRI said it was continuing complex investigations into other activity linked to Russian cyber campaigns against Romanian institutions.