Romania Uncovers Russian-Coordinated Sabotage Network Behind Arms Factory Arson Attempt

The Romanian Intelligence Service (SRI) has exposed a sabotage network coordinated from Russia that was behind an arson attempt on the Carfil arms factory in Brașov on 14 September. The agency announced the findings in a statement, as reported by European Pravda.

Investigators determined that three citizens of post-Soviet states, all legally residing in European Union countries, took part in the attempt. Digi24 reported that the suspects are two Belarusian nationals and one Ukrainian national.

Two of the suspects were detained by law enforcement in Germany, where they were allegedly preparing similar crimes. The third was arrested in Poland. The Bucharest Court of Appeal has issued European arrest warrants for all three, and Romanian authorities have started extradition proceedings.

According to the intelligence service, the group did not operate only in Romania. Its Russian handlers reportedly assigned it a range of targets across the region, including state-owned and private arms manufacturers and other sites with military and industrial significance.

The service described the case as one part of a wider campaign of Russian-coordinated sabotage across Europe. Investigations carried out this year have revealed other attempts against facilities in Romania, among them international military sites and installations used to train Ukraine's Armed Forces. Such actions, the service said, aim to intimidate, erode defence capabilities and discourage countries from contributing to European and regional security.

Romanian intelligence also explained how these networks typically recruit. Contact is usually made through social media, with recruits first offered money for simple jobs such as monitoring or photographing particular sites. The tasks then grow more serious and can escalate to destruction, arson or even murder. Those who refuse may face pressure and blackmail from their handlers.

The networks tend to target people with financial difficulties, addictions or criminal records. To hide their identities and movements, members often rely on transport, accommodation and payment methods registered in other people's names. They also use SIM cards from third countries and encrypted messaging applications to communicate.

"The Intelligence Service, together with the Directorate for Investigating Organised Crime and Terrorism, General Directorate for Defence Intelligence and the Ministry of Internal Affairs, is continuing to investigate sabotage operations detected within the country," the statement said.

The announcement comes amid growing warnings from European leaders. Romanian President Nicușor Dan recently pointed to a rise in Russian provocations across the EU, while Polish Prime Minister Donald Tusk said intelligence indicated a possible escalation of Russia's hybrid war against Europe before Christmas.