Romania Uncovers Alleged Russian Sabotage Network Targeting Arms Plant

Romania’s domestic intelligence service said it had uncovered a sabotage network coordinated by Russian intelligence services that attempted to set fire to an arms factory, adding to concerns that covert attacks could disrupt Europe’s defense production and critical industrial infrastructure.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network attempted to ignite a fire on September 14 at the Carfil weapons manufacturing plant in Brașov, central Romania. The suspects include two Belarusian citizens and one Ukrainian citizen.

According to the agency, coordinators in Russia provided the group with an extensive list of potential targets across the region, including state-owned and private arms manufacturers and other sites of military and industrial significance.

“Coordinators from the Russian Federation identified an extensive list of targets in the region for the group,” SRI said in a statement quoted by Reuters.

Reuters said it could not immediately reach the Russian Embassy in Bucharest for comment. Moscow has repeatedly denied similar allegations.

Industrial security becomes an economic policy concern

The Romanian disclosure raises the economic stakes surrounding Europe’s drive to expand defense output. Attempts to damage weapons plants, drone factories or communications infrastructure can impose costs beyond the immediate physical losses, including higher insurance premiums, tighter security requirements, production delays and additional public spending on counterintelligence.

For governments seeking to replenish military inventories while supporting Ukraine, such disruptions could also complicate procurement schedules and place further pressure on defense budgets. The broader implication is that industrial resilience is increasingly becoming part of macroeconomic and fiscal planning, particularly for European Union and NATO members located near Ukraine.

Two of the suspects were detained in Germany while preparing similar acts of sabotage, while the third is wanted in Poland, Romanian television channel Știri reported. Bucharest is seeking their extradition to Romania.

The case follows arrests by Poland and Romania a year ago of eight people suspected of involvement in a Russian plan to send parcels containing explosives to Ukraine. Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as part of a broader sabotage campaign across Europe directed against defense production, according to AFP.

Romania is a member of both the European Union and NATO and shares a land border of more than 600 kilometers with Ukraine. President Nicușor Dan has previously said Romania is a target of hybrid warfare conducted by Russia to destabilize countries supporting Ukraine’s defense against Russian military aggression.

Recruitment model widens corporate exposure

SRI said people involved in such operations are typically recruited through social media. Initial approaches may offer payment for apparently harmless assignments, such as observing or photographing designated sites. The tasks then become progressively more serious and may include vandalism, arson or even murder, the agency said.

That recruitment model creates a diffuse risk for companies because activity may begin outside conventional security perimeters. Manufacturers and infrastructure operators may therefore face pressure to strengthen employee awareness, monitor unusual surveillance around facilities and coordinate more closely with national authorities.

The Wall Street Journal reported on October 20, citing three European officials familiar with US intelligence findings, that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO countries. The newspaper identified a failed drone attack at Germany’s Leipzig airport on August 4 as one of the campaign’s first actions.

After that incident, Russia allegedly warned the German government through an unofficial communications channel that Leipzig would not be the final target, according to people familiar with the conversation cited by the newspaper. The reported escalation in covert operations coincided with a lack of significant Russian military advances in Ukraine and more frequent Ukrainian strikes on targets deep inside Russian territory.

A series of further incidents followed. Drone-manufacturing facilities in Estonia and Poland were set on fire in August, while Slovak authorities reported preventing an attempted arson attack on a similar production site. Poland, Lithuania and Bulgaria also reported sabotage targeting ground stations used by the Starlink satellite system.

Western officials cited by the Journal said the activity was organized by the Special Tasks Department of Russia’s Main Directorate of the General Staff, a unit established after the start of the military invasion of Ukraine. The department is headed by Colonel General Andrei Averyanov. Western intelligence services also concluded that Colonel Denis Smolyaninov, described as one of the unit’s senior officials, was involved in the Leipzig operation, according to the report.

For European policymakers, the alleged campaign suggests that higher defense production alone may not be sufficient. Protecting factories, logistics networks and communications systems could require sustained investment, deeper cross-border intelligence cooperation and contingency planning designed to prevent isolated attacks from creating wider supply shocks.