SRI says it stopped a cyberattack by APT Turla against a Romanian government organisation, detected in December 2025. Its disclosure matters because it describes a contained intrusion into an allied state’s public infrastructure, not a demonstrated theft of Romanian state secrets.
According to the Romanian Intelligence Service, its National Cyberintelligence Centre identified the interference and acted to neutralise it. SRI said the attackers exploited several system vulnerabilities in Microsoft operating systems. It also said no confidential-data leak was found and that the affected email service has been restored.
That is a significant operational outcome. A government email service can be an entry point to sensitive correspondence and networks; stopping an intrusion and restoring the service limits the immediate disruption described by SRI. Romania also said it informed allies promptly and handled the consequences in cooperation with intelligence partners, the EU and NATO.
But the public account should not be stretched further than it goes. SRI did not identify the targeted institution, name the vulnerabilities, describe how long access lasted, or disclose the scope of any access achieved. The supplied report also contains no response from Russia or from the group named by Romanian authorities.
SRI linked the operation to APT Turla, a group it described as connected to Russia’s FSB. That attribution is central to the seriousness of the case, but the public disclosure does not set out the underlying technical evidence. The useful conclusion is therefore narrower and stronger: Romanian authorities report that they detected and stopped a government-focused intrusion, found no confidential-data leak, and restored email operations. The episode is a reminder for Ukraine and its partners that cyber resilience depends on rapid detection and coordinated response as much as on public attribution.
SRI said it is continuing comprehensive investigative measures into other incidents connected with cyber campaigns conducted by Russia.
Sources
- Українська правда · Source date: 2026-11-11
Independent editorial content. WUA is not affiliated with any political party. 2026-11-11