Russian Turla hackers compromised a Romanian government institution and intercepted emails about NATO and the EU

On December 23, 2025, the Russian cyberespionage group Turla compromised the Microsoft Exchange servers of a Romanian government institution to selectively collect emails concerning NATO and the European Union. The attack was identified and countered by the Romanian Intelligence Service, which announced that its effects had been remediated.

The information appears in a report published by ESET, one of Europe’s leading cybersecurity solutions providers. Researchers identified a new set of malicious tools, called Cereal, used by Turla to install itself on email servers and intercept correspondence without leaving obvious traces.

The hackers used the CerealBox component to execute commands in memory and search for messages containing .DOC, .DOCX, or .PDF attachments. The collection was filtered based on the sender, recipient, and subject. Another component, CerealNeuron, enabled commands to be sent to the compromised server through the email infrastructure.

ESET initially observed the same tools at a government institution in Kazakhstan at the end of 2025, and identified them in Romania one month later.

The Romanian Intelligence Service confirmed the attack and stated that the National Cyberint Center informed the legally authorized beneficiaries and cooperated with partners in the EU and NATO. The institution said it continuously investigates attacks attributed to the Russian Federation and is also analyzing other possible stages of the campaign. Turla, also known as Snake, Secret Blizzard, or Waterbug, is associated with Russia’s FSB.