Sergey Chelevaty, the General Director of Ukrinform, confirmed the cyberattack in a comment to the Ukrainian media outlet “Ukrainska Pravda” (UP). He stated that the agency is working to eliminate the consequences of the incident in coordination with the Security Service of Ukraine (SBU) and the State Special Communications Service. Chelevaty noted that this is not the first attack in recent months, pointing to an incident on the night of November 6 where hackers compromised an email newsletter account for UP, sending a fake letter to readers claiming a “terrorist attack in Kyiv.” The UP editorial team clarified that they did not send the letter and urged readers not to click any links within it.
The technical and strategic context of these attacks has evolved significantly. Chelevaty indicated that in 2024–2025, the agency installed new equipment with the assistance of American partners to bolster its defenses. However, he acknowledged that the adversaries are improving their methods, specifically mentioning the use of artificial intelligence systems by the attackers. “The enemy is also constantly improving, so we are trying to react as quickly as possible,” Chelevaty said. The agency’s official Telegram channel later confirmed that specialists are investigating the circumstances, assessing the impact, and restoring normal operations, noting that the opponent is applying new methods and tools, which necessitates continuous strengthening of protection.
While the Ukraine incidents appear to be demonstrative and reputationally damaging, a parallel and more clandestine operation was unfolding in Romania. The Romanian Intelligence Service (SRI) announced that it had stopped a cyberattack by the Russian hacker group APT Turla against a Romanian government organization. The National Cyber Intelligence Center detected the intervention in December 2025 and immediately took measures to neutralize the threat. According to the SRI statement, the attackers exploited a series of system vulnerabilities in Microsoft operating systems. Thanks to the intervention of the Cyber Intelligence Center, the attack was halted, no leakage of confidential data was detected, and the compromised email service was restored. The SRI emphasized that the incident was reported to allies in a timely manner, and the consequences were mitigated through close cooperation with partners within the intelligence community, as well as at the EU and NATO levels.
APT Turla, also known as Snake, Uroburos, Venomous Bear, or Secret Blizzard, is identified by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a unit of the Russian FSB’s “Center 16.” Operating since at least 2004, Turla is considered one of the world’s oldest and most technically prepared cyber-espionage units. Unlike groups focused on financial fraud or infrastructure destruction, Turla specializes in long-term, hidden infiltration and the theft of strategic secrets. Its primary targets include foreign ministries, defense departments, diplomatic missions, research institutes, and NATO/EU structures. The group develops its own spyware and uses extremely complex masking methods, including compromising the digital infrastructure of hackers from other countries to conduct operations under a false flag.
This Romanian incident is part of a documented pattern of Turla’s activity. In August 2025, Microsoft exposed a large-scale espionage campaign by Turla, which used the Russian System for Operative-Search Activities (SORM) and provider infrastructure to monitor foreign embassies in Moscow. During that campaign, the malicious software “ApolloShadow” was deployed on diplomats’ devices to intercept confidential traffic, passwords, and access tokens. Furthermore, in July 2026, the European Union exposed a multi-year cyber operation by the FSB’s 16th Center against several European states, including Romania, Germany, France, and Poland, leading to sanctions against Russian intelligence officials and diplomatic protests.
The broader regional context reveals a sustained pressure on national digital infrastructure. In November, hackers stole data of approximately 750,000 citizens from Moldovan government systems, prompting the prime minister to call for increased security investments. Similarly, on the evening of November 10, 2026, Polish cyber specialists detected and stopped an attempt to hack the state ePUAP platform, through which citizens access electronic services.
The distinction between the visible defacement of Ukrinform and the invisible infiltration of Romanian state systems illustrates the two faces of modern state-sponsored cyber warfare. The former serves immediate political and psychological objectives, leveraging AI-enhanced tools to disrupt public communication. The latter, represented by Turla’s operations, seeks long-term strategic intelligence through persistent, low-and-slow exploitation of system vulnerabilities. As Ukrainian officials work to restore their digital presence and Romanian agencies continue their comprehensive investigative measures against other incidents linked to Russian cyber campaigns, the reliance on international intelligence sharing and rapid technical response remains the primary defense against these evolving threats.
