On 26 October 2026, the Romanian Intelligence Service (SRI) announced that, in cooperation with domestic and foreign partners, it had identified a sabotage network coordinated from the Russian Federation. The network was involved in a fire that broke out on 14 September 2026 at the Carfil industrial site in Brașov, in the immediate vicinity of CARFIL SA, a subsidiary of the national defence company ROMARM.
The fire affected the premises of several commercial companies located on the same industrial platform. The investigation, conducted jointly by the SRI, the Directorate for Investigating Organised Crime and Terrorism (DIICOT) and other agencies, established the involvement of three nationals of former Soviet states who were legally residing in European Union countries: two Belarusians and one Ukrainian.
The Bucharest Court of Appeal issued European arrest warrants for all three. Two of the suspects were detained and placed in pre-trial detention in Germany, where, according to prosecutors, they were preparing similar acts of sabotage. The third was located in Poland; a warrant for him was issued on 26 October. Romanian authorities have initiated extradition proceedings for all three. They are charged with attempted acts of diversion (sabotage).
According to the SRI, the network’s activities were not limited to Romania. Russian coordinators had assigned the group an extensive list of targets across the region, including state-owned and private arms production facilities as well as other sites of military and industrial interest. The case forms part of a broader campaign of sabotage operations coordinated by Russia in Europe. Other attempts targeting facilities in Romania were also identified this year, including international military facilities and sites used for the training of Ukrainian armed forces.
The SRI stresses that such actions are intended to intimidate, impair defence capabilities and weaken the contribution of the targeted states to European and regional security. The service also warned about recruitment methods: typically conducted via social media, beginning with offers of money for seemingly harmless tasks (observation or photographing of sites) that can later escalate to arson, destruction or even assassinations. If a person refuses, handlers may resort to pressure and blackmail. The networks frequently exploit financial vulnerabilities and the criminal backgrounds of recruits.
Investigations and checks continue with the involvement of the SRI, DIICOT, the Ministry of National Defence and the Ministry of Internal Affairs of Romania, in coordination with European and transatlantic partners.
