defensenews.com
Negativedefensenews.com · · US
Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU
Executive Summary
AI-generatedA Slovak cybersecurity firm disclosed that Russian hackers, attributed to the FSB's Turla group, infiltrated Romanian government servers in late 2025. The attackers utilized a sophisticated malware suite called Cereal to scan and exfiltrate sensitive emails related to NATO and the European Union. This attack highlights the ongoing threat of state-sponsored cyber espionage against Eastern European infrastructure.
Key Insights
- Hackers linked to Russia's FSB (Turla) compromised Romanian government servers in December 2025.
- The attackers used a modular malware tool, Cereal, designed to filter and collect emails concerning NATO and the EU.
- The malware was highly stealthy, using the target organization's own Microsoft Exchange servers for command-and-control rather than external servers.
- The attack was discovered by the Bratislava-based cybersecurity firm and was noted to be similar to a prior infiltration of a Kazakh government agency.
- Turla is known to target post-Soviet or post-communist states, and Romania is a key member of NATO's eastern flank.
Topic context
Related topics
The full article is on the original publisher site.
