Recent cyberattacks on Romania’s critical infrastructure are part of a large-scale hybrid operation by Russia aimed at undermining stability within the country, Dan Cîmpean, head of Romania’s National Cybersecurity Directorate, said at an international forum in Kyiv, as reported by The Records.
In recent months, the country has faced a series of organized incidents involving ransomware. Vital sectors were targeted, including the National Water Agency, the oil pipeline operator, and major energy companies, including coal-fired power plants. Responsibility for the attacks was claimed by Russian-speaking hacker groups Qilin and Gentlemen.
Although these attacks outwardly resemble ordinary criminal profit-seeking, Romanian authorities emphasize their direct connection to Moscow’s geopolitical interests.
Dan Cîmpean noted that the attacks are systematic and carefully planned to coincide with major political decisions, especially those related to Romania’s support for Ukraine. According to his agency, about 80 percent of all cyber incidents in the country are carried out by criminal groups supported by Russian intelligence. Cîmpean explained that it is in Russia’s interest to incentivize hackers by providing them financial independence through extortion of Western companies.
Regarding ransom payments, Romanian authorities maintain a firm stance: the state does not negotiate with cyberterrorists. For government institutions, such payments are legally impossible, and private businesses are strongly advised not to pay hackers, as this does not guarantee data recovery. The head of the cyber police also added that, in addition to mercenary gangs, there is activity by hacker groups directly sponsored by the Russian state. At this stage, they are primarily focused on covertly maintaining access to networks rather than immediately destroying systems.
Moscow’s particular focus on Romania is explained by its strategic position as a NATO and EU member, its access to the Black Sea, and its active support for Ukraine and Moldova. In response to ongoing threats, Romania, Ukraine, and Moldova have already signed a memorandum to strengthen regional cooperation in cybersecurity.
Dan Cîmpean emphasized that Russia tests the country’s ability to respond to threats on a daily basis, trying to destabilize economic and social life. He also warned that the cyberwar against Europe could intensify even after active combat in Ukraine ends, meaning countries must prepare for a prolonged confrontation in the digital space.
