Romania’s intelligence agency has disclosed that a Russian-linked hacking group targeted a government institution in December 2025, with the cyberattack stopped after authorities exploited vulnerabilities in Microsoft operating systems.
The Romanian Intelligence Service (SRI) said on Wednesday that its National Cyberint Centre had detected the activity attributed to APT Turla, a hacking group linked to Russia’s Federal Security Service (FSB). It said the intervention prevented the attack from succeeding and measures had been taken to address its effects.
The agency confirmed that no sensitive data had been extracted and the affected email service had been restored. It did not identify the government institution targeted or disclose the full extent of the attempted compromise.
SRI said the attackers had exploited systemic vulnerabilities in Microsoft operating systems before the National Cyberint Centre intervened to stop the operation. The agency added that it had notified the relevant authorities and cooperated with European intelligence partners, as well as organisations at EU and NATO level.
Cybersecurity firm ESET reported on 10 November that Turla had targeted the Romanian institution using previously undocumented malware. According to the company, the malicious software was designed to identify emails sent or received from NATO and the European Union, suggesting an interest in communications involving the two organisations.
SRI said it was continuing complex investigative work into other activity connected to cyber campaigns conducted by Russia. It added that the National Cyberint Centre would continue monitoring and investigating attempts to compromise Romanian government institutions.
The incident comes as Romania has reported a series of security threats it attributes to Russian activity. The country, which is a member of both NATO and the European Union, shares a land border of more than 600 kilometres with Ukraine.
Romanian president Nicusor Dan has previously described the country as a target of Russian hybrid warfare intended to destabilise nations supporting Kyiv. He has cited drone incursions into Romanian airspace, cyberattacks, disinformation campaigns, sabotage and incidents involving cargo vessels near Romanian waters.
Russia has repeatedly denied accusations that it is conducting hybrid warfare against European states.
