SRI Says It Stopped Turla’s Cereal Attack in Romania

Romania’s foreign intelligence service says it detected a Russian-linked intrusion in a national government institution in December 2025, stopped the attack, and has not identified any exfiltration of sensitive data. In an 11 November 2026 press release, the Serviciul Român de Informații (SRI) said that, through its National Cyberint Centre, it “a identificat acest atac cibernetic în decembrie 2025” — identified this cyber attack in December 2025 — and put in place measures to counter it and to remedy its effects. “În urma intervenției Centrului Național Cyberint atacul a fost oprit”: following the centre’s intervention, the attack was stopped. “Nu au fost identificate exfiltrări de date sensibile, serviciul de e-mail afectat fiind remediat”: no exfiltration of sensitive data was identified, and the affected email service has been remediated.

The institution itself is not named. SRI says the attackers “au exploatat o serie de vulnerabilități sistemice la nivelul sistemelor de operare Microsoft” — exploited a series of systemic vulnerabilities in Microsoft operating systems. It says it informed its legal beneficiaries and that the matter was the subject of cooperation with European partners in the intelligence community, and with partners at the EU and NATO. Further investigations, it adds, also cover other sequences connected with cyber campaigns implemented by the Russian Federation.

The news is that disclosure, not a new breach dated 10 or 11 November. The intrusion, on the official timeline, is from the end of last year.

What ESET says it found on the mail server

A day earlier, on 10 November 2026, ESET Research published its account of a toolset it calls Cereal, built to run on Microsoft Exchange servers, issue commands, map a compromised organisation, and collect selected email. ESET says it first found the toolset on 28 November 2025 at a government organisation in Kazakhstan, then, after tightening detections, at a Romanian government organisation “compromised on December 23rd, 2025.” In the Romanian case, a component named CerealBox “was configured to identify emails sent to, or received from” NATO and the EU.

ESET attributes Cereal “with high confidence” to Turla, which it says is “widely assessed to be part of Russia’s Federal Security Service (FSB).” SRI’s statement also names “actorul cibernetic rus APT TURLA.” Those are SRI’s and ESET’s attributions.

The defensive detail in ESET’s write-up is how the operators hid the control channel. The researchers say they did not find external command-and-control infrastructure. “The victim’s own internet-facing Exchange server is the operator-accessible control point.” CerealBox, ESET says, is injected into Exchange’s EdgeTransport.exe process and hooks existing transport agents rather than registering a new one, a method it calls “a novel technique, not previously documented for any malware family.” Indicators of compromise are published on ESET’s GitHub. For anyone still running Exchange in a government or allied network, the practical implication is the one SRI has already emphasised: detect the collection on the mail service, stop the intrusion, and confirm whether mail actually left.

That is the same shape of work ESET has been publishing on other Russia-aligned sets this year. Its linkage of a 2025 wiper attack on a Ukrainian grain firm to Sandworm and a second group was another high-confidence attribution built from tooling and targeting. A later ESET APT activity report on a Belarus-aligned wiper likewise turned on what defenders could actually see in a compromised organisation. Romania has also had to handle a separate attack on the central depository’s investor app, a different incident, but a reminder that official disclosures here often arrive months after the first detection.

The useful news is that the attack was found and stopped

Readers should keep the dates and the limits in view. SRI identified the intrusion in December 2025, says the attack was stopped, and says no sensitive data exfiltration has been identified. ESET dates the Romanian compromise to 23 December 2025 and first saw the same toolset in Kazakhstan on 28 November. The 10–11 November publications are the public accounting of that detection and response, not evidence of a live, unremediated breach this week. The victim institution in Romania remains unnamed, and TSN has no independent confirmation of ESET’s NATO and EU mail-collection setting beyond the company’s report.

What can be taken from the two official accounts is still useful for defenders: a long-running Exchange-focused collection set, attributed by both SRI and ESET to Turla, that used the victim’s own mail server as the control point, and that, in SRI’s telling, was found, stopped, and followed by a remediated email service. The facts to watch are any later naming of the institution, any revision of the “no sensitive data exfiltration” finding, and further official detail on the Microsoft vulnerabilities SRI says were used. Until then, the story is a delayed disclosure of a stopped intrusion, not a fresh compromise.