Romania Uncovers Alleged Russian Sabotage Network Targeting Arms Plant

Romania’s domestic intelligence service says it has uncovered a Russian-coordinated sabotage network that attempted to set fire to an arms factory, intensifying concerns about the security of Europe’s defence industry and the resilience of supply chains supporting Ukraine.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network had been “directly coordinated by the intelligence services of the Russian Federation.” According to the agency, the group tried on September 14 to ignite a fire at the Carfil weapons manufacturing plant in Brașov, central Romania.

The allegations carry significance beyond Romania. Britain and European Union countries are expanding defence production while supplying military assistance to Kyiv, making factories, transport links and communications infrastructure increasingly important to the region’s security. The source report provided no immediate evidence of a specific reaction in London-listed defence shares or sterling, but repeated incidents could raise operating, insurance and security costs across the European industrial base.

“Coordinators from the Russian Federation identified an extensive list of targets in the region for the group: state and private arms manufacturers, as well as other sites of military and industrial interest,” Romanian intelligence said, according to Reuters.

Reuters was unable to contact the Russian embassy in Bucharest immediately for comment. Moscow has repeatedly denied similar allegations.

Suspects detained and sought across Europe

The suspects include two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while preparing similar acts of sabotage, while the third is wanted in Poland, Romanian broadcaster Știri reported. Bucharest is seeking their extradition to Romania.

The case follows arrests by Poland and Romania a year earlier of eight people suspected of involvement in an alleged Russian plan to send parcels containing explosives to Ukraine. The latest investigation therefore adds to European concerns that covert operations may cross several jurisdictions and target both public and privately owned businesses.

Romania is a member of both the EU and NATO and shares a land border of more than 600 kilometres with Ukraine. Romanian President Nicușor Dan has previously said that his country is a target of hybrid warfare conducted by Russia to destabilise states supporting Ukraine’s defence against Russian military aggression.

Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as “part of a broader sabotage campaign across Europe” directed against defence production, according to AFP.

Recruitment allegedly begins with minor assignments

SRI said people used in such operations are typically recruited through social media. According to the service, prospective recruits are initially offered money for an apparently harmless assignment, such as observing or photographing particular sites.

“Subsequently, the tasks become increasingly serious and may include acts of vandalism, arson or even murder,” the intelligence service said.

The recruitment model outlined by SRI presents a challenge for European governments and businesses because it may rely on loosely connected individuals rather than conventional intelligence officers. For British and EU defence companies, the allegations underline the importance of protecting facilities and monitoring risks extending beyond factory gates to contractors, logistics providers and other industrial infrastructure.

Claims of a wider campaign against NATO states

The Wall Street Journal reported on October 20, citing three European officials familiar with US intelligence conclusions, that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO countries. According to the newspaper, an unsuccessful drone attack at Germany’s Leipzig airport on August 4 was among the first operations in that campaign.

After the incident, Russia allegedly used an unofficial communications channel to warn the German government that Leipzig would not be the final target, the newspaper reported, citing people familiar with the conversation. The increase in covert activity coincided with a lack of significant Russian military advances in Ukraine and more frequent Ukrainian strikes on sites deep inside Russian territory.

A series of further incidents in Europe reportedly followed Leipzig. Drone manufacturing facilities in Estonia and Poland were set on fire in August, while Slovak authorities said they had prevented an arson attack against a similar production site. Poland, Lithuania and Bulgaria also reported sabotage affecting ground stations used by the Starlink satellite system.

Western officials say the activity is organised by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit created after Russia began its military invasion of Ukraine. The department is headed by Colonel General Andrei Averyanov. Western intelligence agencies also determined that Colonel Denis Smolyaninov, one of the unit’s senior figures, was involved in the Leipzig operation, according to the Wall Street Journal.

For London and European markets, the immediate question is whether governments respond with additional security requirements or spending for strategically important manufacturers. The allegations do not establish a direct effect on sterling or UK equities, but they reinforce the security pressures accompanying Europe’s drive to increase defence output.