www.gandul.ro/actualitate/hackeri-rusi-atac-romani

The Russian hacking group Turla has targeted government institutions in Romania and Kazakhstan using a sophisticated tool called Cereal. This malware was specifically designed to compromise servers and discreetly collect emails, particularly those related to NATO and the EU. ESET researchers revealed that two national government organizations were attacked, with incidents occurring in Kazakhstan and Romania in late 2025. The operation highlights the group's interest in Romania's foreign and defense policies amid regional tensions. The malware operates stealthily, modifying existing server processes to avoid detection, and utilizes advanced encryption techniques. Notably, the compromised server itself was used as a command point for the attack, complicating detection efforts.