Cyberattack thwarted as a result of the intervention of the Cyberint National Center

Regarding the information that has appeared in the public space concerning the attempt by the Russian cyber actor APT TURLA to compromise a national government institution at the end of last year, the Romanian Intelligence Service makes the following clarifications:

SRI, through the National Cyberint Center, identified this cyberattack in December 2025, took measures to contain it and address its effects. The attackers exploited several systemic vulnerabilities within Microsoft operating systems, but following the intervention of the National Cyberint Center, the attack was stopped.

No exfiltration of sensitive data was identified, and the affected email service was restored. In addition, SRI informed the relevant legal beneficiaries. Furthermore, the incident was addressed in cooperation with European partners within the intelligence community, as well as with structures within the EU and NATO.

SRI/ The National Cyberint Center is currently conducting complex investigations into other sequences connected to cyber campaigns carried out by the Russian Federation.

SRI/ The National Cyberint Center will continue to act consistently to identify and investigate any new attempts to compromise national institutions.