Romania says it thwarted cyberattack by Russian hacking group Turla on government institution

The Romanian Intelligence Service (SRI) said its National Cyberint Center detected the intrusion in December 2025 and took measures to contain the attack and address its effects.

According to the agency, the hackers exploited multiple vulnerabilities in Microsoft operating systems. The attack affected the institution's email service, which was subsequently restored.

SRI said investigators found no evidence that sensitive data had been extracted.

The intelligence service did not identify the targeted government institution.

Romanian authorities shared information about the incident with relevant national bodies and intelligence partners in Europe, including through cooperation at the EU and NATO levels.

SRI said it was also conducting investigations into other incidents connected to cyber campaigns carried out by Russia.

APT Turla is a long-running cyberespionage group widely linked to Russia's Federal Security Service (FSB). It has been associated with operations targeting government agencies, diplomatic institutions and other organizations.

The disclosure comes amid separate reports of cyberattacks affecting European public services and infrastructure. No connection between those incidents and the Romanian attack has been established.