PrivacyAffairs

🇷🇴🇷🇺 NEW: RUSSIAN FSB-LINKED HACKERS COMPROMISED ROMANIAN GOVERNMENT AGENCY TO SPY ON NATO AND EU COMMUNICATIONS Cybersecurity firm ESET has revealed that the Russian state-linked hacking group Turla compromised a Romanian government organisation using previously undocumented malware designed to intercept sensitive email correspondence. The intrusion occurred on December 23, 2025, but was publicly disclosed today, November 10, 2026. KEY FINDINGS: • TARGET: An unidentified Romanian government organisation operating Microsoft Exchange email servers. • NATO AND EU: The malware was specifically configured to identify and collect emails exchanged with NATO and EU institutional addresses. • NEW MALWARE: The attackers deployed a sophisticated modular espionage toolset named Cereal, previously undocumented by researchers. • EMAIL INTERCEPTION: A component called CerealBox infiltrated legitimate Microsoft Exchange processes, allowing attackers to collect selected messages without disrupting normal email delivery. • STEALTH: The malware executed code in memory and disguised malicious communications as legitimate Exchange web traffic. • COMMAND AND CONTROL: Rather than relying on external attacker-controlled infrastructure, the compromised Exchange server itself was used to receive commands. • RUSSIAN INTELLIGENCE: ESET attributes the operation with high confidence to Turla, a cyberespionage group linked to Centre 16 of Russia’s Federal Security Service (FSB). • SECOND VICTIM: The same malware was also discovered at a government organisation in Kazakhstan in November 2025. IMPORTANT CONTEXT: In July 2026, Romania’s Foreign Ministry publicly acknowledged that the country had been targeted by malicious cyber activities conducted by Turla. The newly disclosed operation provides technical evidence of a compromise involving Romanian government communications with NATO and the EU. The affected Romanian agency has not been publicly identified, and the findings do not establish that NATO or EU systems themselves were compromised.