Hackers linked to Russia’s FSB compromised servers belonging to a Romanian government organization in December 2025, collecting emails connected to NATO and the European Union, according to findings released by Slovak cybersecurity company ESET.

The attackers used an advanced collection of tools that ESET researchers named Cereal, a reference to serialization technology. The malicious software scanned email moving through Romanian government servers and copied messages when it detected connections to NATO or the EU.

One component, called CerealBox, specifically searched for messages involving NATO and EU institutional addresses. It selected emails carrying Word or PDF attachments through predefined filters, then compressed and encrypted copies so the attackers could retrieve them later.

ESET discovered the Romanian infiltration and publicly disclosed the operation on Nov. 10. The Bratislava company first found the tool operating against Kazakhstan in November 2025, then uncovered its presence on Romania’s Microsoft Exchange servers roughly one month later.

The company attributed the campaign to Turla, a known hacking group that ESET said is generally considered affiliated with Russia’s FSB, the country’s domestic intelligence agency. Turla primarily attacks government institutions and has also conducted operations against prominent Ukrainian targets.

According to the researchers, 70% of countries targeted by Turla were former Soviet or communist states across Eastern Europe and Central Asia. The group is classified as an Advanced Persistent Threat, a term used for an identified hacking organization conducting sustained cyber operations.

ESET said it attributed Cereal to Turla with high confidence. Researchers cited the simultaneous use of another component publicly connected to the group, along with conceptual similarities between Cereal and older Turla malware.

Investigators also identified a surge in activity in Kazakhstan on Jan. 15, 2026, one day after Old New Year, an informal holiday observed in Russia and several neighboring countries. ESET dryly observed, “While malware does not celebrate holidays, its operators do.”

The Romanian servers were compromised on Dec. 23, 2025, according to ESET. That breach occurred roughly one month after the company detected the same malicious code operating on a server belonging to a Kazakh government agency.

The Kazakhstan discovery marked the first time researchers had encountered the tool. ESET called it “a previously undocumented toolset: a collection of modular .NET malware designed to run on Microsoft Exchange servers, receive commands, execute them in memory, map the compromised organization, and collect selected email messages.”

Researchers said Cereal stood apart because of its “combination of novel techniques requiring deep knowledge of Exchange internals with unusual .NET execution methods.” Its modular structure allowed the attackers to issue commands, examine the victim organization and select particular email messages for collection.

The toolkit was designed to remain hidden for long periods while conducting espionage. Typical malware often communicates with an external command and control server, creating activity that can assist cybersecurity professionals in detecting an intrusion and tracing its possible origin.

Cereal instead used Microsoft servers belonging to the targeted organization as its operational infrastructure. That approach helped the attackers avoid the more familiar external communications associated with many malicious software operations and made the campaign especially stealthy.

Romania is a NATO member on the alliance’s eastern flank and has experienced physical and digital spillover from the confrontation between Russia and the West. Those consequences have become particularly pronounced since the full scale invasion of Ukraine began.

The country has faced airspace violations, drone shootdowns and a strike involving commercial vessels inside its exclusive economic zone. It has also endured cyber warfare aimed at government systems and businesses connected to military support for Ukraine.

In May 2025, another known Russian Advanced Persistent Threat actor attacked arms manufacturers supporting Ukraine, including companies in Romania. Months after the war began, a crude distributed denial of service attack also made Romanian public authority and financial sector websites unavailable for several hours.