Russian hackers attack companies in Bulgaria and Romania that supply military equipment to Ukraine

According to a report published in May 2025 by the cybersecurity company ESET, cited by BTV, the Russian hacker group Fancy Bear (APT28) has carried out a large-scale cyber espionage campaign called RoundPress. This campaign has targeted government and military organizations in Eastern Europe, including Bulgaria and Romania.

The report states that Fancy Bear is linked to Russia's military intelligence GRU. The hacker group has used vulnerabilities in webmail platforms to steal sensitive information such as passwords, contacts, and personal data. Although the report does not mention specific companies supplying military equipment, the targets include government, military, and defense organizations.

The hackers have been active since 2023, but their latest detected activity was on April 17 this year. The report emphasizes that some of the affected companies in Bulgaria and Romania produce Soviet-era weapons intended for Ukraine.