Russian-linked hackers target the accounts of Balkan officers and Ukrainian officials

Russian-linked cyberattacks have compromised military email accounts in Romania, Greece and Bulgaria, in what cybersecurity researchers say is part of a broader campaign targeting EU defence institutions and Ukrainian officials, with hundreds inboxes breached between 2024 and 2026.

Dozens of Romanian Air Force email accounts and 27 accounts within Greece’s military command have been compromised in separate but likely connected cyber campaigns attributed to Russian-linked actors, raising fresh concerns over the resilience of European defence infrastructure.

Romania’s Ministry of National Defence (MApN) confirmed on Wednesday that 67 cyberattacks had targeted the Romanian Air Force, resulting in the compromise of “a few dozen” email accounts. The attacks were detected in March 2025 and contained within 24 hours by military cyber defence units.

According to the ministry, at least 67 email accounts were accessed, including some linked to NATO bases and a senior officer. However, the authorities stressed that the affected data was unclassified and used primarily for administrative communication and the circulation of public information, with no evidence of classified data being exfiltrated.

The MApN added that an additional 30 attempted breaches were unsuccessful. Following the incident, Romania centralised its cybersecurity systems in March 2026, placing digital defence entirely under a central command while increasing monitoring and vulnerability mitigation efforts.

Parallel revelations in Greece point to a similar pattern. Russian-linked hackers infiltrated 27 email accounts managed by the Hellenic National Defence General Staff, the country’s top military authority, according to data verified by Reuters.

Among the compromised accounts were those of Greek military attachés in India and Bosnia and Herzegovina, as well as a public email address belonging to the Joint Armed Forces’ Mental Health Centre. The data was inadvertently exposed online by the attackers themselves and later identified by Ctrl-Alt-Intel, a UK- and US-based cybersecurity research collective.

In Bulgaria, the hackers broke into at least four mailboxes belonging to local officials in the region of Plovdiv. Bulgarian officials did not respond to comment requests, Reuters reported

The data also shows the spies hacked academics and military officials in Serbia, a traditional Russian ally. Serbia’s Ministry of Defence did not respond to requests for comment.

Ukrainian breach

Reuters reported that Russian-linked hackers broke into more than 170 email accounts belonging to prosecutors and investigators across Ukraine during the past several months. The campaign illustrates how Moscow’s operatives are seeking to monitor officials tasked with tackling corruption and identifying suspected collaborators.

The data was inadvertently exposed online by the hackers and discovered by Ctrl-Alt-Intel, a collective of British and American cyber threat researchers. Ctrl-Alt-Intel said the material left on the server, including logs of successful operations and thousands of stolen emails, showed that the hackers compromised at least 284 inboxes between September 2024 and March 2026.

The group attributed the campaign to “Fancy Bear”, one of the aliases commonly associated with a Russian military-linked hacking unit. Two independent researchers who reviewed the findings agreed that the activity was tied to Moscow, although some experts have previously cautioned against definitive attribution to that specific group.

“The hackers likely targeted Ukrainian law enforcement either to stay ahead of investigators working to expose Moscow’s spies or to gather potentially embarrassing information about top officials in Kyiv,” said Keir Giles, an associate fellow at the Chatham House think tank, who reviewed a list of the victims.

The data showed the hackers accessed accounts managed by the Specialised Prosecutor’s Office in the Field of Defence, a wartime body established to combat corruption and uncover espionage within the Ukrainian military.

They also targeted Ukraine’s Asset Recovery and Management Agency (ARMA), which oversees assets seized from criminals and Russian collaborators, as well as the Kyiv-based Prosecutor’s Training Center.

Among the victims was Yaroslava Maksymenko, who was head of ARMA at the time, according to the data. At the Prosecutor’s Training Center, hackers accessed the mailboxes of 44 employees, including that of deputy director Oleg Duka.

The data further showed breaches of the Central City Hospital in Pokrovsk – a strategic railway hub contested by Russian forces — as well as an account linked to the city’s finance committee. Russia has repeatedly denied conducting cyber operations against foreign states. The Russian embassy in Washington did not respond to requests for comment.

Sources: Reuters, Umbrela strategica, BGNES

Caption: AI-generated illustrative image