Kathrine Frich
Russia’s war with the West is no longer confined to the battlefield.
From cyberattacks to disinformation campaigns, Moscow has increasingly relied on hybrid tactics to target European countries.
A newly uncovered hacking operation now offers a rare look inside one of these covert efforts.
Massive breach
According to Reuters cited by Hotnews, hackers with alleged ties to Russia compromised at least 284 email accounts between September 2024 and March 2026.
The victims included prosecutors, investigators, and military personnel across Ukraine, as well as officials in Romania, Bulgaria, Greece and Serbia.
The data was uncovered after hackers accidentally exposed logs and stolen emails online, which were later analyzed by the Ctrl-Alt-Intel research group.
Critical mistake
Researchers said the breach became visible due to a major operational error by the hackers.
“They simply made a huge operational mistake. They left the front door wide open,” Ctrl-Alt-Intel said.
The exposed data included detailed records of hacking activity and thousands of stolen messages.
Romania targeted
In Romania, at least 67 email accounts belonging to the Air Force were compromised.
These included accounts linked to NATO air bases and at least one senior military official.
Authorities have not publicly commented on the findings, Reuters reported.
Wider operation
The campaign also targeted institutions in several other countries.
In Greece, hackers accessed 27 accounts linked to the General Staff of the Hellenic National Defense, including those of military attachés.
In Bulgaria, officials in Plovdiv province were affected, while in Serbia both academics and military personnel were targeted.
Hybrid warfare
Romanian officials have linked the attacks to a broader pattern of Russian cyber activity.
The country’s intelligence service said Russia had “compromised a wide range of entities globally, including in Romania, particularly targeting critical infrastructures and information from the military and government domains.”
“Russia is therefore continuing its hybrid war against Western countries, and only those in bad faith do not see this. Romania must improve its cybersecurity and continue to collaborate with Western partners,” President Nicușor Dan said.
Who is behind it?
The operation has been linked by researchers to the group known as “Fancy Bear,” a hacking unit widely associated with Russian military intelligence.
However, some cybersecurity experts said the exact attribution remains uncertain.
US authorities have previously tied similar activity to the GRU’s cyber units, which have been accused of targeting infrastructure and stealing sensitive data worldwide.
Sources: Reuters, Hotnews.
