Hackers linked to FSB stole NATO emails from Romanian servers

Full text

VIENNA — Hackers linked to Russia’s FSB quietly compromised a Romanian government organization’s servers to collect emails related to NATO and the EU in December 2025, a Slovak cybersecurity firm has revealed.

Using an advanced suite of tools that the researchers dubbed Cereal, a pun on the technology of serialization, emails going through Romanian government servers were scanned for a relation to NATO and the European Union. If this was discovered, the malicious software would create a copy for its Russian spymasters.

In particular, one component, CerealBox, targeted messages involving NATO and EU institutional addresses, the cybersecurity form ESET said. The module selected emails with Word or PDF attachments using predefined filters, then compressed and encrypted copies for later retrieval by the attackers.

The hack was discovered by the Bratislava-based company and made public on Nov. 10. ESET had first discovered the tool being used against Kazakhstan in November 2025, and found the infiltration of Romania’s Microsoft Exchange servers a month later.

In a blog post and press release, the company attributed the attack to the known hacking group Turla, which it said was generally considered to be affiliated with Russia’s FSB, the country’s domestic intelligence agency. Turla has also been involved in attacks against high-profile Ukrainian targets, and the researchers said 70% of countries the group targeted were post-Soviet or post-communist states in Eastern Europe and Central Asia. The APT – a term designating an “Advanced Persistent Threat,” or known hacking group – primarily attacks government institutions.

ESET attributed the toolset to Turla with high confidence, citing the simultaneous use of another component publicly linked to the group and conceptual similarities to older Turla malware.

The researchers also noted a surge in activity in Kazakhstan on Jan. 15, 2026, the day after Old New Year, an informal holiday observed in Russia and some neighboring countries. “While malware does not celebrate holidays, its operators do,” the company wrote.

Romanian servers were compromised on Dec. 23, 2025, ESET researchers said; roughly a month after the cybersecurity firm first detected the same malicious code on the server of a Kazakh government agency. That discovery was the first time this tool had been seen, which the researchers described as “a previously undocumented toolset: a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map the compromised organization, and collect selected email messages.”

The tool was unusual for its “combination of novel techniques requiring deep knowledge of Exchange internals with unusual .NET execution methods,” ESET wrote.

The tool was designed to be especially stealthy, meant to allow it to spy undetected at length. While malware commonly communicates with an external command-and-control server, which can lead to detection and help cybersecurity professionals trace the origin, Cereal used the target organization’s own Microsoft servers as its infrastructure.

Romania is an eastern flank member of NATO and has faced physical and digital spillover of the confrontation between Russia and the West, particularly since the full-scale invasion of Ukraine began. Airspace violations, drone shootdowns and even the strike of commercial vessels in its exclusive economic zone have been among the consequences.

The country has also been targeted by cyber warfare. In May 2025, another known Russian APT actor attacked arms makers involved in supporting Ukraine, including those located in Romania; and just months after the war broke out, government websites were hit by a crude distributed denial-of-service attack, making Romanian public-authority and financial-sector websites unavailable for several hours.