Romania says Russian-linked sabotage network behind fire at defence facility

Romania says Russian-linked sabotage network behind fire at defence facility
Screen shot of a video posted by Romanian Intelligence Service (SRI) showing alleged Russian sabotage on 14 September 2026.
Romanian Intelligence Service, SRI via Facebook

Romanian authorities say they have uncovered a sabotage network allegedly coordinated from Russia and linked to a fire near a defence manufacturing site in the central city of Brasov, underscoring growing concerns about hybrid threats targeting military infrastructure across Europe.

The Romanian Intelligence Service (SRI) said the network was responsible for a fire that broke out on 14 September at the Carfil industrial platform, close to the facilities of Carfil SA, a subsidiary of Romania's state-owned defence company CN ROMARM.

Romanian Foreign Minister Dan Neculaescu described the incident as part of a broader pattern of attacks aimed at Europe's defence industry.

“Hybrid attacks will not hold us back from strengthening our resilience and defence,” Neculaescu wrote on social media platform X.

Arrests made in multiple countries

Romania's Directorate for Investigating Organised Crime and Terrorism (DIICOT) said three individuals have been identified in connection with the case: two Belarusian nationals and one Ukrainian national.

Prosecutors said two of the suspects were located and arrested in Germany while allegedly preparing similar sabotage operations. Romanian authorities also issued a European arrest warrant for the third suspect, who was reported to be in Poland.

The cross-border nature of the investigation has highlighted the increasing role of international cooperation in responding to alleged sabotage and espionage activities targeting strategic infrastructure.

Network allegedly targeted military and industrial sites

According to the SRI, the group's activities extended beyond Romania's borders and involved attacks against facilities considered important to defence production and national security.

Investigators said the alleged coordinators in Russia assigned targets that included public and private weapons manufacturers as well as other military and industrial sites.

The intelligence agency added that separate investigations conducted this year uncovered what it described as additional attempted attacks in Romania, including plots targeting international military facilities and locations used to train Ukrainian forces.

Romanian officials have not publicly released evidence supporting the allegations, and there has been no immediate response from Russian authorities.

Growing concerns over hybrid threats

The case comes amid heightened vigilance across Europe over suspected sabotage operations, cyberattacks and other forms of hybrid activity directed at defence infrastructure and logistics networks linked to support for Ukraine.

Western governments have repeatedly warned that military facilities, weapons production sites and transport corridors have become increasingly attractive targets for covert operations as Russia's war in Ukraine continues.

Neculaescu said Romanian authorities had succeeded in exposing what he described as “a sabotage network coordinated by the Russian Federation” behind the Brasov incident.

Defence cooperation expands despite security concerns

The alleged sabotage operation comes as Carfil SA seeks to expand cooperation with international defence partners.

The company recently signed a memorandum of understanding with Greek firm Altus LSA covering collaboration in autonomous systems, counter-drone capabilities and defence technologies.

The agreement forms part of broader efforts by Romania to strengthen its defence industrial base and increase cooperation with European partners amid a changing security environment.

Romanian authorities said investigations remain ongoing as prosecutors continue to examine the network's activities and pursue the remaining suspect.

Read more:

Tags