Turla’s Cereal Toolkit Thwarted in Romanian Government Email System

Romanian intelligence services disclosed that a Russian state‑linked APT group, Turla, attempted to infiltrate a government email platform in December 2025. The intrusion was detected early by the Romanian Intelligence Service (SRI) and stopped before any sensitive information could be exfiltrated.

What happened

SRI’s National Cyberint Center identified malicious activity on Microsoft operating systems and immediately deployed counter‑measures that halted the attack. The compromised email service was restored and no data loss was reported.

Technical details

The attackers leveraged a previously unknown toolkit called Cereal to monitor traffic on Microsoft Exchange servers. According to The Record, the malware was configured to intercept messages addressed to or from NATO and EU institutions, indicating a strategic focus on diplomatic communications. The operation exploited multiple systemic vulnerabilities in Microsoft’s OS stack, although the exact entry points remain undisclosed.

Who is affected

The primary victim was a Romanian government email system, though the specific agency was not named. A claim by ESET suggests that a similar campaign also targeted government email servers in Kazakhstan, but this has not been independently confirmed.

Why it matters to the public

Even though the breach was contained, the attempt highlights the persistent threat posed by sophisticated state‑backed actors to public sector communications. Intercepted diplomatic emails could have been used for espionage, disinformation or to influence policy decisions. The rapid response by Romanian authorities prevented potential exposure of classified correspondence and preserved trust in government digital services.

Advice for ordinary users

While the incident did not affect private email accounts, the tactics used—exploiting unpatched OS flaws and deploying custom malware—are common in broader ransomware and phishing campaigns. Users should ensure that operating systems and email clients are kept up to date, enable multi‑factor authentication where possible, and be wary of unexpected attachments or links, especially from unknown senders.

Response and cooperation

SRI informed legal beneficiaries of the incident and shared technical details with EU and NATO intelligence partners, reinforcing collective defence against similar threats. A press release on 11 November 2026 confirmed that the attack was fully neutralised.

Sources

• sri.ro (official)
• The Record

This brief was prepared with AI assistance from the sources above and reviewed by our editors.