Cyberattack attributed to a Russian hacker group thwarted by the SRI. Government institution targeted

The attempt to compromise IT systems was discovered in December 2025; the intervention of the National Cyberint Center made it possible to counter the attack and remediate its effects.

According to information released by the SRI on Wednesday, the attackers exploited several systemic vulnerabilities within Microsoft operating systems in an attempt to compromise the IT infrastructure of the targeted institution.

Following the intervention of specialists from the National Cyberint Center, the attack was stopped, and the affected email service was restored.

SRI: No sensitive data stolen

Representatives of the Romanian Intelligence Service state that, following their investigations, no exfiltration of sensitive data was identified. In other words, authorities found no evidence that confidential information had been extracted from the compromised IT systems.

The SRI reports that the relevant legal beneficiaries were informed of the incident, and the situation was addressed in cooperation with European partners within the intelligence community, as well as with structures within the European Union and NATO.

Investigations are ongoing. Other attacks attributed to Russia are also being analyzed

The National Cyberint Center continues to conduct complex investigations, which also encompass other incidents and sequences linked to cyber campaigns attributed to the Russian Federation.

The SRI (Romanian Intelligence Service) states that it will continue efforts to identify and investigate attempts to compromise Romanian institutions, in light of cyber threats targeting the national IT infrastructure.

The SRI identifies the APT group TURLA as the Russian cyber actor involved in the attempted attack detected late last year.