A hacking group linked to Russia’s FSB security service staged a cyberattack on a Romanian government organisation last year, the country’s intelligence agency said on Wednesday.
Russia’s embassy in Romania did not immediately respond to a request for comment.
Romania, a European Union and NATO member, shares a land border of more than 600 km (370 miles) with Ukraine, and centrist President Nicusor Dan has said it is the target of a hybrid war waged by Russia to destabilise nations that support Kyiv.
The attacks have ranged from drone incursions into Romanian airspace to cyberattacks, disinformation campaigns, acts of sabotage and attacks on cargo vessels near Romanian waters, Dan has said. Russia has repeatedly denied accusations that it is waging hybrid war against European states.
Russian-linked APT hacking group Turla was behind the December 2025 cyberattack, Romania’s intelligence agency SRI said, adding that it had “implemented measures to counter the attack and remedy its effects”.
“The attackers exploited a series of systemic vulnerabilities in Microsoft operating systems, but the attack was stopped after the National Cyberint Centre intervened,” SRI said in a statement.
“No exfiltration of sensitive data was identified, and the affected email service has been fixed,” it added, without identifying the government organisation that was targeted.
Cybersecurity firm ESET said on Tuesday that Turla had targeted the unnamed Romanian state institution by using previously undocumented malware designed to identify emails sent or received from NATO and the EU.
SRI said it had cooperated with EU and NATO partners in this case.