[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fivzicgbi2ds2xw-cC11WqMScRGagOu2vTKilqcWAGYo":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2b48963d-a76c-47d4-b1d9-3f27e84ceb8f","Romania says it stopped Russian cyberattack targeting government emails","romania-says-it-stopped-russian-cyberattack-targeting-government-emails-96ca28","Romania's intelligence agency said it stopped a cyber-espionage campaign by Russian state-linked hackers before the group exfiltrated sensitive data.","Romania's intelligence agency (SRI) detected and stopped a cyberespionage campaign by Russian state-linked hackers, attributed to the Turla group, in December 2025. The campaign targeted a government institution, aiming to intercept emails exchanged with NATO and EU institutions by exploiting vulnerabilities in Microsoft systems. Slovak cybersecurity firm ESET identified a new malware, dubbed Cereal, used in the attack, which allowed secret monitoring of email traffic and maintaining access to compromised Microsoft Exchange servers.","Romania stopped a Russian cyberespionage campaign targeting government emails.","https:\u002F\u002Ftherecord.media\u002Fromania-russia-cyberattack-emails","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FRomania_European_Commission_8f0c949789.jpg","2026-11-12T13:30:00+00:00","2026-11-12T14:00:16.264187+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":19},"Secret Blizzard",{"name":23,"type":19},"Venomous Bear",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"Microsoft Exchange","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":47,"value":55,"context":56},"Cereal","Previously unknown hacking toolkit used by Turla to compromise government email servers.",[25,28],{"controls":59,"vendors":143},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":82,"vendor_name":25,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":118,"name":119,"problem":120,"products":121},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":82,"vendor_name":25,"vendor_logo":83,"product_slug":139,"product_name":140,"url":141,"description":142},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[144,150],{"slug":145,"name":146,"logo_path":147,"roles":148},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[149],"reported_by",{"slug":82,"name":25,"logo_path":83,"roles":151},[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"russian-turla-group-exploits-microsoft-exchange-vulnerabilities-to-spy-on-nato-linked-government-ema","Russian Turla Group Exploits Microsoft Exchange Vulnerabilities to Spy on NATO-Linked Government Emails","The Turla group, a Russian state-linked threat actor, exploited unpatched vulnerabilities in Microsoft Exchange servers used by a Romanian government institution to intercept sensitive email communications with NATO and EU partners. The attackers deployed a novel malware strain called Cereal, enabling covert, persistent access to email traffic without initially triggering detection. This incident underscores that internet-facing email infrastructure handling classified or sensitive diplomatic communications is a high-value target that demands prioritized and timely patch management. Delays in applying security updates to critical systems — especially those bridging government and allied networks — can have serious geopolitical consequences.",[158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(e)","MITRE ATT&CK T1114: Email Collection",{"NIS2 Article 21(2)(e)":164,"MITRE ATT&CK T1114: Email Collection":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"CIS Control 7: Continuous Vulnerability Management (v8)":167,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":168},"This point requires security in the acquisition, development, and maintenance of systems, including vulnerability handling; a formal process for promptly addressing Exchange vulnerabilities would have been mandated under this obligation for the government institution involved.","The Cereal malware's core capability — secretly monitoring and intercepting email traffic on the Exchange server — maps directly to this technique, and detection controls targeting T1114 (such as mailbox audit logging and anomalous access alerts) would have identified the campaign earlier.","SI-2 mandates identifying, reporting, and correcting system flaws in a timely manner; had Exchange vulnerabilities been remediated promptly under a formal flaw-remediation process, the attackers could not have installed the Cereal malware.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in their systems; timely patching of the Microsoft Exchange flaws exploited here would have denied Turla its initial foothold.","Continuous monitoring of Exchange server network activity would have provided earlier detection of the covert email interception and persistent access established by the Turla malware."]