Romanian intelligence agency says it identified Russian-linked cyber attack

A hacking group linked to Russia's ​FSB security service staged a ​cyberattack on a Romanian government ‌organisation last ​year, the country's intelligence agency said on Wednesday. Russia's embassy in Romania did not immediately respond to a request ‌for comment.

Romania, a European Union and NATO member, shares a land border of more than 600 km (370 miles) with Ukraine, and centrist President Nicusor Dan has said it ‌is the target of a hybrid war waged by Russia to destabilise ‌nations that support Kyiv. The attacks have ranged from drone incursions into Romanian airspace to cyberattacks, disinformation campaigns, acts of sabotage and attacks on cargo vessels near Romanian waters, Dan has said. Russia has ⁠repeatedly ​denied accusations that ⁠it is waging hybrid war against European states.

Russian-linked APT hacking group Turla was behind the December 2025 ⁠cyberattack, Romania's intelligence agency SRI said, adding that it had "implemented measures to counter the attack and ​remedy its effects". "The attackers exploited a series of systemic vulnerabilities in Microsoft ⁠operating systems, but the attack was stopped after the National Cyberint Centre intervened," SRI said in a ⁠statement.

"No ​exfiltration of sensitive data was identified, and the affected email service has been fixed," it added, without identifying the government organisation that was targeted. Cybersecurity ⁠firm ESET said on Tuesday that Turla had targeted the unnamed Romanian state institution ⁠by using previously undocumented ⁠malware designed to identify emails sent or received from NATO and the EU.

SRI said it had cooperated with EU and ‌NATO ‌partners in this case.