Romania arrests suspects in Russian-led factory fire

The Romanian Intelligence Service identified a sabotage network controlled from Russia that attempted to set fire to the Carfil arms factory in Brașov on 14 September. The agency stated that the group was composed of three citizens from post-Soviet states who held legal residence in European Union countries. According to Digi24, the suspects include two Belarusians and one Ukrainian. Law enforcement detained two of the individuals in Germany, where they were allegedly preparing similar crimes, while the third was arrested in Poland. The Bucharest Court of Appeal issued European arrest warrants for all three, and Romanian authorities have initiated extradition proceedings.

Intelligence officials reported that the network's objectives extended beyond the initial attack in Brașov. Russian handlers assigned the group multiple targets across the region, focusing on state-owned and private arms manufacturers as well as other sites with military or industrial value. The service characterized the incident as part of a wider campaign of sabotage operations coordinated by Russia across Europe. Investigations conducted during 2026 have uncovered additional attempts targeting facilities in Romania, including international military sites and bases used to train the Ukrainian Armed Forces.

The intelligence service warned that these operations aim to intimidate local populations, undermine defense capabilities, and weaken national contributions to European security. Recruiters typically approach potential agents through social media, offering payment for initial tasks such as monitoring or photographing specific locations. Assignments escalate over time, moving from surveillance to acts of destruction, arson, or murder. If a recruit refuses further tasks, handlers may apply pressure or use blackmail to maintain control.

Members of these networks often exploit financial vulnerability, addiction, or criminal records to conceal their identities. They use transport, accommodation, and payment methods registered in the names of third parties. Communication relies on SIM cards from third countries and encrypted messaging applications. The Romanian Intelligence Service, along with the Directorate for Investigating Organised Crime and Terrorism, the General Directorate for Defence Intelligence, and the Ministry of Internal Affairs, continues to investigate other sabotage operations detected within the country.

Romanian President Nicușor Dan recently noted an increase in Russian provocations across the European Union. Polish Prime Minister Donald Tusk stated that intelligence suggests a possible escalation of Russia's hybrid war against Europe before Christmas. The current case adds to a series of incidents that have drawn attention to the strategic use of foreign nationals in European sabotage efforts.