SRI says it stopped a cyberattack attributed to APT Turla against the email server of a Romanian government institution, but its public account leaves two consequential questions unanswered: which institution was targeted and how far any sensitive-data exposure reached.
According to the SRI account reported by HotNews, the attack took place in late December 2025 and was identified that month by the National Cyberint Center. SRI said the attackers exploited systemic vulnerabilities in Microsoft operating systems, that the operation was stopped, and that the affected email service was repaired.
The stakes go beyond a disrupted server. HotNews reported that ESET researchers had disclosed a program installed on the server that searched correspondence involving institutional NATO and EU addresses. If that was the operation’s purpose, the apparent interest was not merely opportunistic access but communications potentially relevant to Romania’s external and security relationships.
SRI also said it informed its legal beneficiaries and cooperated with European intelligence partners as well as EU and NATO partners. A rapid response can contain the effects of a compromise. Yet a technical repair does not replace a public explanation when the target is a state institution and sensitive data are at issue.
SRI did not identify the affected institution or say what categories of data were exposed, how many people or departments were affected, or whether information was taken. The attribution to APT Turla is SRI’s official position; the supplied material does not provide an independent technical assessment of that attribution.
For now, the authorities have described how the incident was stopped, not its administrative scale. A further update should explain, within legitimate security limits, which public function was affected and what concrete data risk was addressed. That is necessary for the public and partner institutions to assess the consequences of an intrusion directed at government email infrastructure.
Sources
- HotNews · Source date: 2026-11-11
Independent editorial content. WUA is not affiliated with any political party. 2026-11-11