Ransomware group
Qilin
Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022.
Read more
Significant cyber incident
Cyber attacks and platform manipulation around Romania’s 2024 presidential election
The cyber attacks and platform manipulation around Romania's 2024 presidential election led the Constitutional Court to annul the whole election process on 6 December 2024.
In short
The cyber attacks and platform manipulation around Romania's 2024 presidential election led the Constitutional Court to annul the whole election process on 6 December 2024. On 28 November the Supreme Council of National Defence said cyber attacks aimed to influence the first round held on 24 November. On 17 December the European Commission opened formal proceedings against TikTok under the Digital Services Act.
What happened
Romania held the first round of its presidential election on 24 November 2024. On 27 November the Supreme Council of National Defence (CSAT) had on its agenda an analysis of threats from state and non-state cyber actors on the IT and communications infrastructure used in elections. On 28 November the council said there were cyber attacks aimed at influencing the first round. It said Romania, like other states on NATO’s Eastern Flank, had become a priority for hostile actions of state and non-state actors, especially the Russian Federation.
On the same day the Special Telecommunications Service (STS) gave a different picture. It said it had found no vulnerabilities in the communications and IT services it provided to the Permanent Electoral Authority, and that neither before nor during the election had it received information from other bodies about cyber attacks. Sources differ on this point, and the pages opened do not settle it.
In early December the president declassified the reports shown to CSAT. Radio Romania International wrote that, according to the documents, the increase in accounts promoting one independent candidate was not organic and was allegedly coordinated by a state-sponsored actor. It also wrote that cyber attacks took place on election day and the following night, and that intelligence services said tens of thousands of Russian cyber attacks targeted the Permanent Electoral Authority. The Romanian Intelligence Service report also said Romania is a target for aggressive hybrid actions from Russia.
On 6 December the Constitutional Court annulled the whole presidential election process. President Iohannis said the decision followed the CSAT materials, which showed that an external state influenced the process in favor of a candidate. On 17 December the European Commission opened formal Digital Services Act proceedings against TikTok on election risks, citing the Romanian election and declassified intelligence reports from the Romanian authorities.
Timeline
-
24 November 2024
First round of the presidential election.
-
27 November 2024
A CSAT meeting agenda covers cyber threats to IT and communications infrastructure used in elections.
-
28 November 2024
CSAT says there were cyber attacks aimed at influencing the first round, and that a candidate got massive exposure through preferential treatment on TikTok.
-
28 November 2024
The STS says it found no vulnerabilities in the services it gave the Permanent Electoral Authority and received no information on cyber attacks from other bodies.
-
5 December 2024
Radio Romania International reports that the president declassified the reports shown to CSAT; it says intelligence services speak of tens of thousands of Russian cyber attacks on the Permanent Electoral Authority.
-
5 December 2024
The Foreign Ministry says it briefed allied states. The Commission asks TikTok to preserve information linked to the EU election.
-
5 December 2024
The Prosecutor General's Office announces a criminal investigation based on the CSAT documents (week-in-review, Radio Romania International).
-
6 December 2024
The Constitutional Court annuls the whole presidential election process. President Iohannis links the decision to the CSAT materials.
-
17 December 2024
The European Commission opens formal proceedings against TikTok under the Digital Services Act on election risks.
How the attack worked
Two lines of activity
The public sources describe two lines of activity. The first is cyber attacks on the infrastructure that supported the vote. CSAT said there were cyber attacks aimed at influencing the first round. Radio Romania International wrote that attacks took place on election day and the night after, and that intelligence services said tens of thousands of Russian attacks targeted the Permanent Electoral Authority. The pages opened give no technical detail: no method, tool or group is named, and no ATT&CK technique is given.
Platform manipulation
The second line is the manipulation of an online platform. According to the declassified reports as described by Radio Romania International, the number of accounts promoting one candidate rose in a way that was not organic, and the accounts were allegedly coordinated by a state-sponsored actor. CSAT also said the candidate benefited from preferential treatment by TikTok. The European Commission says its proceedings will examine whether TikTok’s recommender systems and its handling of political ads and paid political content managed the risks, including coordinated inauthentic manipulation or automated exploitation of the service.
Disputed points
The STS said it found no vulnerabilities in the services it provided to the Permanent Electoral Authority and had received no information about cyber attacks from other bodies. Radio Romania International wrote that Russia was the source of the attacks, citing intelligence services. The pages opened do not include the declassified documents themselves, so this page repeats only what the reports and official bodies were said to state. The Commission also stresses that opening proceedings does not prejudge the result.
- TargetCyber attacks on the IT systems supporting the vote, including on election night
- AmplifyAccounts promoting one candidate grew in a way that was not organic, allegedly coordinated by a state-sponsored actor
- ExposeCSAT cited preferential exposure on TikTok and told the authorities to act
- DiscloseThe president declassified the reports shown to CSAT in early December
- ActThe court annulled the process on 6 December; the Commission opened DSA proceedings on 17 December
Who says who was behind it
No group is named. Attributed by CSAT, 28 November 2024: Romania has become a priority for hostile actions of state and non-state actors, especially the Russian Federation (as reported by Radio Romania International).
Attributed by Romanian intelligence reports declassified in early December 2024, as described by Radio Romania International on 5 December 2024: the accounts promoting a candidate were allegedly coordinated by a state-sponsored actor. The same outlet wrote that intelligence services said the attacks on the Permanent Electoral Authority were Russian. The Romanian Intelligence Service report says Romania is a target of aggressive Russian hybrid actions.
President Iohannis, 6 December 2024: the CSAT materials showed an external state got involved and influenced the process (Radio Romania International).
Sources differ: on 28 November 2024 the STS said it had received no information about cyber attacks from other bodies and found no vulnerabilities in the services it provided. The declassified documents were not opened for this page, and Russia's response is not in the pages opened.
Impact
Election result: the Constitutional Court annulled the whole presidential election process on 6 December 2024, according to Radio Romania International. The same outlet wrote that new dates would be set by the new government.
Systems: no source opened reports that vote counts were altered or that systems failed. The STS said it found no vulnerabilities in its services to the Permanent Electoral Authority.
Scale: Radio Romania International wrote that intelligence services spoke of tens of thousands of cyber attacks on the Permanent Electoral Authority. It is a report of what services said, not a count from an official statement opened.
Legal and regulatory: the Prosecutor General's Office announced a criminal investigation based on the CSAT documents. The European Commission opened formal proceedings against TikTok on 17 December 2024. The Commission says this does not prejudge the outcome.
Cost figures were not stated in the sources opened.
Government and regulator response
- 28 November 2024: CSAT asked the authorities responsible for national security, for running the election, and for criminal investigation to act urgently on the findings. The STS stated its position on the services it provided.
- Early December 2024: The president declassified the reports shown to CSAT. The Foreign Ministry said it briefed allied states and that the authorities were investigating. The Prosecutor General’s Office announced a criminal investigation.
- 5 December 2024: The European Commission asked TikTok to preserve information linked to the EU election.
- 6 December 2024: The Constitutional Court annulled the whole election process.
- 17 December 2024: The Commission opened formal Digital Services Act proceedings against TikTok on election risks, taking into account declassified intelligence reports by the Romanian authorities. Ireland’s Digital Services Coordinator was associated to the investigation.
Lessons
-
Treat election IT as critical infrastructure
CSAT put cyber threats to election IT on its agenda before the vote, and the Permanent Electoral Authority was reported as a target on election night.
-
Share threat information between bodies
The STS said it had received no information from other bodies about attacks, while intelligence services spoke of tens of thousands. Make sure the operator of a system sees what intelligence services see.
-
Platform risk is election risk
CSAT and the Commission both focus on how a social platform ranked and promoted content and handled paid political content.
-
Declassify early where possible
The president declassified the reports, and the Commission said it used them. Public evidence helped other bodies to act.
-
Be careful with numbers
The figure of tens of thousands of attacks comes from a news report of intelligence statements. Ask what counts as an attack before relying on it.
-
Plan for the legal path
The case produced a court annulment, a criminal investigation and EU proceedings at the same time. Organizations that run public votes should keep logs and evidence for each of these.
What to check in your own organization
-
Election and public-vote IT
List the systems that support any public vote or filing deadline you run, and who monitors them on the day and the night after.
-
Log retention
Keep network and application logs long enough to answer a regulator or court months later, as the Commission ordered TikTok to preserve data.
-
Information flow
Agree how national security bodies tell system operators about attacks on their systems, and test it.
-
Account and ad monitoring
If you run a public brand or campaign, watch for accounts that suddenly promote it or attack it in a coordinated way.
-
Credential exposure
Check for leaked credentials of staff who run public portals; this is a common first step for attackers, and sources opened do not say it was used here.
-
Denial of service readiness
Test that public sites can stay up under heavy traffic on key dates.
-
Disinformation response
Decide who speaks for your organization, and how fast, when false claims spread about your systems.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Romania Romania is targeted by Russian state-linked actors and hacktivists, according to official sources. Europe
Questions
What did Romanian authorities say about cyber attacks on the election?
On 28 November 2024 the Supreme Council of National Defence said there were cyber attacks aimed at influencing the first round. Radio Romania International wrote that intelligence services spoke of tens of thousands of Russian attacks on the Permanent Electoral Authority.
Did the STS find a breach?
No. On 28 November 2024 the STS said it found no vulnerabilities in the services it gave the Permanent Electoral Authority and had received no information on attacks from other bodies.
Who was behind it?
No group is named in the pages opened. Romanian bodies pointed at a state-sponsored actor and at Russia. See the attribution note for who said what.
Why did the court cancel the election?
The Constitutional Court annulled the process on 6 December 2024. President Iohannis said the decision followed the CSAT materials showing an external state influenced the process. The court's own text was not opened.
What did the European Commission do?
On 17 December 2024 it opened formal Digital Services Act proceedings against TikTok on election risks, taking into account declassified intelligence reports by the Romanian authorities. The Commission says this does not prejudge the outcome.
Sources
- November 27, 2024 UPDATE Radio Romania International
- November 28, 2024 UPDATE Radio Romania International
- December 5, 2024 Radio Romania International
- December 5, 2024 UPDATE Radio Romania International
- December 6, 2024 UPDATE 2 Radio Romania International
- Romania hit by cyber attack (5 December 2024) Radio Romania International
- The Week in Review Radio Romania International
- Commission opens formal proceedings against TikTok on election risks under the Digital Services Act (17 December 2024) European Commission
- Cyber Intelligence (Law 58/2023 and national threats) Serviciul Roman de Informatii
- Commission opens formal proceedings against TikTok on election risks under the Digital Services Act European Commission
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.