Romania’s national water management authority, Administrația Națională Apele Române (Romanian Waters), was targeted in a sophisticated ransomware attack on December 20, 2025, compromising approximately 1,000 IT systems across the organization. The cyberattack affected 10 of the country’s 11 regional water basin administrations, including facilities in Oradea, Cluj, Iași, Siret, and Buzău.
Modus operandi
The attackers employed an unusual tactic by weaponizing Windows BitLocker, a legitimate encryption tool designed to protect data, to lock files on compromised systems. Rather than deploying traditional ransomware, the threat actors exploited this built-in Windows security feature in a “living off the land” approach that differs from typical ransomware group operations. After encrypting the systems, the attackers left ransom notes demanding that officials contact them within seven days.
The breach affected critical IT infrastructure including Geographical Information System servers, database servers, email and web services, Windows workstations, and Domain Name Servers. Romanian Waters’ website went offline, forcing the agency to
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: