# Turla-Linked Malware Targets Romanian Exchange Servers

ESET reported that a Romanian government organization’s Microsoft Exchange servers were compromised on December 23, 2025, by the Turla-linked Cereal malware toolkit. The malware selectively copied emails concerning NATO and the European Union. The incident identifies no solicitation, contract value, or procurement contact, but it highlights cybersecurity risks for contractors supporting Romanian government, NATO, or EU networks.

- Contractors supporting these networks can evaluate Exchange security and controls protecting sensitive email data, as well as detection for stealthy in-memory activity—the tactics identified in the incident.
- For procurement planning, this is a threat-driven consideration for organizations providing email, cybersecurity, or network support to Romanian government, NATO, or EU customers; the signal does not identify a specific procurement opportunity or mandate.

**Jurisdictions:** international
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity
**Published:** November 11, 2026

### Government Entities
- Romanian government organization (unnamed)
- North Atlantic Treaty Organization (NATO)
- European Union (EU)

### Sources
- [Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU - Defense News](https://www.defensenews.com/global/europe/2026/11/11/romanian-servers-targeted-by-russian-hackers-to-scoop-up-emails-about-nato-eu) - Defense News