Romania

This page covers cyber threats to Romania. It brings together official Romanian texts (the Romanian Intelligence Service, the data protection authority and the Ministry of Health), the European Commission, a joint government advisory published by CISA, news reports of official statements, and Brandefense research. We could not open the websites of the national cyber directorate DNSC, the Romanian government or the presidency. Where a DNSC or presidency statement reaches us through a news report, the page says so.

Threat groups that official sources link to Romania

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT28: the Romanian Intelligence Service (SRI) said on 8 April 2026 that it took part, with international partners, in Operation Masquerade against a network of routers used by APT28 (Fancy Bear), which it says is attributed to the GRU. The SRI says the actor collected passwords, authentication tokens and sensitive data and compromised entities worldwide, including in Romania, aiming mostly at critical infrastructure and military and government information. A CISA advisory (AA25-141A, last revised 17 April 2026) attributes a campaign against logistics entities and technology companies to GRU military unit 26165, commonly known as APT28. It lists Romania among the countries with targeted entities. It also says Romania made up 9.9% of the targeted IP camera attempts, second after Ukraine.

KILLNET has no profile in our library. The SRI said that the pro-Russian group KILLNET claimed the DDoS attack of 29 April 2022 on the websites of Romanian national authorities and financial and banking institutions.

Incidents on record

The incident pages linked from this page cover major incidents only. They are the February 2024 ransomware attack on a hospital information system and the cyber attacks and platform manipulation around the November 2024 presidential election.

How attackers target Romania: Brandefense research

Overview. Our report Romania Cybersecurity Threat Landscape & Strategic Insights 2025 says Romania faced a surge in dark web activity, ransomware, phishing and disinformation in 2024 and 2025. Its key findings list 3M+ Romanian email addresses leaked on the dark web, ransomware attacks crippling hospitals, parliament and energy providers, deepfake-driven fraud and disinformation, credential leaks in banking, e-commerce and aerospace, and hacktivist DDoS campaigns. These figures come from that report page and we have not rechecked them here.

State-linked espionage. Our Fancy Bear APT Group profile says that in 2018 APT28 targeted two unaffiliated US and Romanian government organizations, and that the first vector was a phishing e-mail with the subject “Upcoming Defense event February 2018”. Our post UAC-0194: Inside a Rapidly Evolving NTLM-Exploiting Espionage Operation says the group appears to target government, diplomatic and administrative bodies in Ukraine, Poland and Romania, using .url, .lnk and .library-ms files to expose NTLMv2 hashes. Our Mythic Leopard APT Group (Transparent Tribe) profile lists Romania among the countries whose critical systems the group targeted.

Cybercrime services. Our post GC01 (Golden Chickens) says the malware-as-a-service operation is believed to be run by people in Montreal, Canada, and Romania/Moldova.

How Brandefense helps

Brandefense has published a Romania threat landscape report for 2024 and 2025 (see above). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Law 58/2023 on cyber security and defense makes the Romanian Intelligence Service the national competent authority for cyber intelligence. The SRI says the law also added three threats to the national security law: cyber attacks on IT and communications infrastructures of national interest, actions that affect the resilience of the state against hybrid risks and threats, and cyber propaganda or disinformation campaigns by state or non-state entities that affect the constitutional order. The SRI points to the Cyber Security Strategy of Romania for 2022 to 2027. The European Commission lists Romania as having transposed the NIS2 Directive (page last updated 8 July 2025). We could not open the Romanian text of the NIS2 transposition, so this page does not describe its rules.

How incident response is organized

The SRI acts through its National Cyberint Center to analyze, prevent and counter cyber incidents that threaten national security. It has powers against advanced persistent threat actors on national networks, except those in the defense ministry, the interior ministry, foreign intelligence, the Special Telecommunications Service (STS) and the protection service. Since July 2020 the center has also been the CERT for the SRI itself. The SRI runs a national protection system for IT and communications infrastructure of national interest.

In the February 2024 hospital attack, the Ministry of Health said DNSC cyber security experts were part of the investigation, and Radio Romania International reported that DNSC worked with the SRI to restore the systems and that the organized crime prosecutor DIICOT opened an investigation. The STS provides communications and IT services to the Permanent Electoral Authority. The Commission’s NIS2 page still lists CERT-RO as national CSIRT and single point of contact. Sources differ on the names of the bodies here, because the Ministry of Health and news reports name DNSC while the Commission page names CERT-RO.

Personal data

The national data protection authority, the ANSPDCP, says it monitors the application of the GDPR and acts with full independence. It publishes the main laws on its site: Law 102/2005 which set it up, Law 129/2018 which amended that law and repealed Law 677/2001, Law 190/2018 which puts the GDPR into effect in Romania, and Law 506/2004 on personal data and privacy in electronic communications.

The official Romanian texts we opened give no national attack counts. Figures for Romania will come from Brandefense Atlas.