Russian FSB Hackers Breach Romanian Government Servers to Intercept NATO and EU Communications

Hackers affiliated with Russia’s Federal Security Service have successfully compromised government servers in Romania and Kazakhstan to intercept sensitive international communications. The sophisticated cyberespionage campaign quietly siphoned emails related to NATO and the European Union. Slovak cybersecurity firm ESET disclosed the breaches on Tuesday.[1][2]

The threat actor, widely known as Turla, deployed a previously undocumented and highly modular malware framework dubbed Cereal. The malicious code was specifically engineered to infiltrate Microsoft Exchange servers and operate undetected for extended periods. Researchers noted the toolset represents a significant evolution in stealthy intelligence gathering.[3][5]

Rather than relying on external command-and-control infrastructure that network defenders could easily spot and block, the attackers weaponized the victims' own systems. The malware disguised its operations as routine email traffic, making the espionage virtually invisible to standard security monitoring.[2][5]

"The Cereal toolset is a carefully constructed instrument for long-term, stealthy cyber espionage," ESET researchers stated in their technical report. "It leaves little on disk, avoids external infrastructure that could be discovered and blocked, and conceals itself within legitimate Exchange processes."[2][3]

Engineering the Cereal Framework

The Cereal framework consists of eight interconnected components that work together to map infected networks, receive commands, and harvest specific data. The malware derives its name from its extensive use of serialization, a process that converts data structures into formats easily stored or transmitted.[3]

To maintain its covert presence, the primary backdoor component, known as CerealNeuron, listens for incoming web requests on paths that mimic normal Exchange traffic. When a properly encrypted request passes the malware's integrity checks, it is decrypted and executed directly in the server's memory.[3][5]

Any unauthorized or improperly formatted request simply returns a legitimate-looking Microsoft Exchange error page. This mechanism effectively turns the compromised government server into the attacker's own operational hub. ESET noted that abusing a compromised Exchange server as a central command post is a rare technique utilized by very few advanced persistent threat groups.[2][5]

The operators deliver commands to the infected servers as small, compiled .NET programs designed for specific tasks. These tasks include retrieving mailboxes, querying Active Directory for user information, extracting local credentials, and performing various file operations.[3][5]

"The sheer volume of near-identical binaries, each compiled for a specific task, strongly suggests that the operators have an internal framework that automates the compilation and packaging of commands," ESET researcher Matías Porolli explained. This modular approach indicates a mature, well-engineered espionage platform rather than a loose collection of scripts.[3][5]

Intercepting the Mail Flow

The most critical component of the espionage operation is CerealBox, an email harvesting module that processes and filters messages directly from the server. To avoid detection, the module injects itself into the Exchange transport service, known as EdgeTransport.exe, which handles the movement of all mail.[2][5]

By wrapping the handlers of transport agents already loaded in memory, CerealBox ensures that mail continues to flow normally while leaving no trace of a new agent in the system's configuration. ESET researchers emphasized that hooking the transport service from the inside has not been documented in any previous malware family.[2][5]

Once embedded in the mail flow, the malware actively scans outgoing and incoming messages for specific criteria. It specifically targets emails containing document attachments that match hardcoded lists of sender addresses, recipient addresses, or subject lines.[3][5]

"Before the email leaves the building, a piece of code quietly examines it," Porolli noted. "It decides that it is interesting, and sets aside a copy to be forwarded to prying eyes, while the original email continues on its way."[5]

Emails that meet the attackers' filtering criteria are immediately compressed, encrypted, and staged in hidden files on the server's disk. The CerealNeuron backdoor then exfiltrates these stolen communications back to the Russian operators in an encrypted format before deleting the local copies.[3][5]

Targeting the Eastern Flank

The breach of the Romanian government organization occurred on December 23, 2025, according to the forensic timeline established by ESET. In this specific intrusion, the CerealBox module was explicitly configured to gather emails involving NATO and European Union institutional addresses.[1][2]

This targeting pattern directly aligns with Russia's strategic intelligence priorities as the conflict in neighboring Ukraine continues to strain regional security. Romania, a crucial eastern flank member of NATO, has faced both physical and digital spillovers from the ongoing confrontation between Moscow and the West.[1][2]

The country has previously dealt with Russian drone incursions into its airspace and targeted cyber warfare against its defense sector. In May 2025, another known Russian threat actor attacked arms manufacturers located in Romania that were involved in supporting the Ukrainian military.[1]

The successful interception of NATO and EU correspondence highlights the persistent vulnerability of government communication channels. While the exact contents of the stolen emails remain undisclosed, the targeted nature of the filters suggests the attackers were seeking high-level diplomatic and military intelligence.[1][2]

The initial access vector used to deliver the Cereal malware into the Romanian networks remains unknown. However, the Turla group is historically known to conduct sophisticated spear-phishing campaigns, watering hole attacks, and adversary-in-the-middle operations at the internet service provider level.[3]

The Kazakhstan Intrusion

Before striking Romania, the Turla operators first deployed the Cereal toolset against a government agency in Kazakhstan. ESET researchers detected this initial compromise on November 28, 2025, roughly a month before the Romanian servers were breached.[1][2]

The intrusion in Kazakhstan occurred amid growing regional scrutiny of Russian exiles and Kremlin critics living in the Central Asian nation. While researchers could not determine if the hackers were specifically seeking information about dissidents, the operation fits Turla's historical pattern of monitoring post-Soviet states.[2]

AI

According to cybersecurity analysts, approximately 70 percent of the countries targeted by the Turla group since 2022 have been former Soviet republics or Eastern European nations. The group, which has operated since at least 2004, is considered one of Russia's most established and capable state-linked hacking units.[1][2]

Forensic analysis of the Kazakhstan breach revealed a notable pause in the attackers' activities on January 15, 2026. This date immediately follows the Old New Year, an informal holiday still widely observed in Russia and several neighboring countries.[1][5]

"While malware does not celebrate holidays, its operators do," the ESET research team observed in their report. This scheduling quirk provided investigators with additional behavioral evidence linking the sophisticated cyberespionage campaign to operators based in the Russian Federation.[1]

A Paradigm Shift in Espionage

The discovery of the Cereal framework demonstrates a significant shift in how state-sponsored actors maintain persistence within high-value networks. By eliminating the need for external command servers, the Turla group has effectively neutralized many standard network defense strategies that rely on monitoring outbound traffic.[2][5]

"The Cereal toolset demonstrates that, for Turla, Exchange servers are not just mail servers," ESET concluded in its analysis. "They are durable collection points, internal execution hubs, and a highly suitable environment for hiding sophisticated .NET tradecraft."[3]

The malware's loader component further illustrates this stealthy methodology, as it is the only part of the toolset written to disk as a recognizable file. It executes native code before the standard runtime environment starts, making it appear harmless to analysts reviewing its basic structure.[5]

As military alliances and government institutions continue to digitize their classified communications, the threat of internal subversion grows more acute. The successful deployment of the Cereal framework serves as a stark warning that sophisticated adversaries are constantly finding new ways to weaponize the very infrastructure designed to facilitate secure communication.[1][2]