Russian spies hacked Romanian servers to steal NATO and EU emails

A hacking group linked to Russia's FSB intelligence agency, known as Turla, compromised Romanian government Microsoft Exchange servers in December 2025. Using a previously undocumented, modular malware toolkit dubbed "Cereal," the attackers scanned emails flowing through the servers. When the system detected messages related to NATO or the European Union, the malware would create encrypted copies for later retrieval by the Russian operators.

The malware specifically targeted emails containing Word or PDF attachments from NATO and EU institutional addresses. This represents a classic espionage operation by a state-backed group, focusing on gathering intelligence from a member state within both NATO and the EU. The discovery by Slovak cybersecurity firm ESET highlights the ongoing, sophisticated digital espionage campaigns targeting geopolitical rivals, with Eastern Europe and Central Asia remaining primary battlegrounds in this shadow cyberwar.