Romania says it stopped Russian cyberattack targeting government emails

The Turla group, a Russian state-linked threat actor, exploited unpatched vulnerabilities in Microsoft Exchange servers used by a Romanian government institution to intercept sensitive email communications with NATO and EU partners. The attackers deployed a novel malware strain called Cereal, enabling covert, persistent access to email traffic without initially triggering detection. This incident underscores that internet-facing email infrastructure handling classified or sensitive diplomatic communications is a high-value target that demands prioritized and timely patch management. Delays in applying security updates to critical systems — especially those bridging government and allied networks — can have serious geopolitical consequences.