Romania Uncovers Alleged Russian Sabotage Network Targeting Arms Plant

Romania’s domestic intelligence service said it had uncovered a sabotage network allegedly coordinated by Russian security services, after the group attempted to set fire to an arms-manufacturing facility in the central Romanian city of Brașov.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network tried to ignite a fire at the Carfil weapons plant on September 14. The case adds to a series of suspected attacks and attempted attacks against defense-related industrial sites across Europe, increasing attention on operational and supply-chain risks surrounding the continent’s arms sector.

For markets, the immediate significance lies less in disclosed financial damage—Romanian authorities provided no estimate—than in the expanding security burden facing European defense manufacturers, logistics providers and infrastructure operators. No trading-volume, share-price or sector-performance data were included in the authorities’ announcement.

“The coordinators in the Russian Federation identified an extensive list of targets for the group in the region: state and private arms manufacturers, as well as other sites of military and industrial interest,” Romanian intelligence said, according to Reuters.

Reuters was unable to immediately reach the Russian Embassy in Bucharest for comment. Moscow has repeatedly denied similar allegations, the news agency noted.

Suspects Detained as Romania Seeks Extraditions

The suspects include two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while preparing similar acts of sabotage, while the third is wanted in Poland, according to Romanian broadcaster Știri. Bucharest is seeking their extradition to Romania.

The investigation follows arrests made a year earlier, when Poland and Romania detained eight people suspected of involvement in an alleged Russian plan to send parcels containing explosives to Ukraine.

Romania is a member of both the European Union and NATO and shares a land border of more than 600 kilometers with Ukraine. Romanian President Nicușor Dan has previously said the country is a target of hybrid warfare conducted by Russia to destabilize states supporting Ukraine’s defense against Russian military aggression.

Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as “part of a broader sabotage campaign across Europe” directed against defense production, according to AFP.

SRI said people involved in such operations are typically recruited through social media. Initial offers may involve payment for apparently harmless assignments, including monitoring or photographing selected sites. The tasks then become progressively more serious and can extend to vandalism, arson or murder, the intelligence service said.

European Defense Sites Face Wider Security Threat

The Romanian disclosure comes amid reports of a broader escalation in covert activity targeting NATO countries. The Wall Street Journal reported on October 20, citing three European officials familiar with US intelligence assessments, that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO members.

According to the newspaper, an unsuccessful drone attack at Germany’s Leipzig airport on August 4 was among the first operations in that campaign. Following the incident, Russia allegedly warned the German government through an unofficial communications channel that Leipzig would not be the final target, according to people familiar with the conversation.

The reported increase in covert operations coincided with a lack of significant advances by Russian forces in Ukraine and more frequent Ukrainian military strikes against targets deep inside Russian territory.

A series of further incidents followed the Leipzig episode. Drone-manufacturing facilities in Estonia and Poland were set on fire in August. Slovak authorities reported during the same period that they had prevented an arson attack against a similar production site. Poland, Lithuania and Bulgaria also reported acts of sabotage at ground stations serving the Starlink satellite network.

Western officials believe the sabotage activity is organized by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit established after the beginning of Russia’s full-scale invasion of Ukraine. The department is headed by Colonel General Andrei Averyanov.

Western intelligence agencies also determined that Colonel Denis Smolyaninov, identified as one of the unit’s senior officers, was involved in the Leipzig operation, according to The Wall Street Journal.

The expanding geographic scope of the alleged campaign places renewed focus on physical security at European defense factories and related infrastructure. The reported targeting of public and private arms producers, drone facilities and satellite-network equipment indicates that the risks extend across multiple segments of the defense supply chain, even where an attempted attack fails to cause reported production losses.