Russian intelligence-linked hackers copied NATO, EU emails from Romanian servers in December 2025

Hackers linked to Russia's Federal Security Service, or FSB, quietly infiltrated Microsoft Exchange servers at a Romanian government organization on Dec. 23, 2025, according to Bratislava-based cybersecurity firm ESET. The intrusion was not opportunistic: the attackers deployed Cereal, a modular.NET malware suite built to run inside Exchange, receive commands, map the organization and collect selected messages. ESET said the operation became public on Nov. 10, after researchers first saw the same toolset against a Kazakh government agency in November 2025.

The evidence trail is technical. CerealBox filtered messages involving NATO and EU institutional addresses and selected Word or PDF attachments, then compressed and encrypted copies for later retrieval. ESET attributed the toolset to Turla, an advanced persistent threat, or APT, generally considered affiliated with Russia's FSB, citing another component publicly linked to Turla and similarities to older malware. ESET said the attribution was high-confidence, based on technical artifacts and known Turla links, not a government statement. It also noted a Kazakh activity surge on Jan. 15, 2026, the day after Old New Year.

The targeting pattern reinforces the intelligence value. ESET said 70% of countries Turla targeted were post-Soviet or post-communist states in Eastern Europe and Central Asia, and the group primarily attacks government institutions. Romania is a NATO eastern-flank member that has seen airspace violations, drone shootdowns and attacks on commercial vessels in its exclusive economic zone since Russia's full-scale invasion of Ukraine. In May 2025, another Russian APT targeted arms makers supporting Ukraine, including Romanian firms.

This matters because compromised mail infrastructure can reveal more than single messages: it can expose contacts, meeting topics, attachment circulation and decision-making rhythms across defense and diplomatic institutions. Cereal's use of the victim's own Microsoft servers as infrastructure made detection harder, and its filters show the operators prioritized NATO and EU correspondence rather than indiscriminate theft. For Romania and allied institutions, the case shows how state-linked espionage can sit inside routine government email flow, turning a trusted communications platform into a collection point.