Alleged Russian Sabotage Network Targets Romania’s Defense Industry

Romania’s domestic intelligence service says it has uncovered a Russian-coordinated sabotage network that attempted to set fire to a weapons factory, exposing a widening security threat to Europe’s defense industry and the companies supporting Ukraine.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network had been directly coordinated by Russian intelligence services. According to the agency, the group attempted on September 14 to set fire to the Carfil arms plant in Brașov, a city in central Romania.

The suspects include two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while preparing similar acts of sabotage, Romanian television channel Știri reported, while the third is wanted in Poland. Bucharest is seeking their extradition to Romania.

The case places Carfil within what Romanian officials describe as a broader campaign against European defense production. It also illustrates how physical security, workforce screening and supply-chain resilience are becoming strategic management priorities for arms manufacturers as governments across Europe accelerate military procurement.

Defense Companies Face a Broader Threat Map

SRI said the group’s coordinators in Russia had identified an extensive list of potential targets across the region, including state-owned and privately controlled weapons producers as well as other sites of military and industrial importance.

“The coordinators from the Russian Federation identified an extensive list of targets in the region for the group: state and private arms-manufacturing enterprises, as well as other sites of military and industrial interest,” SRI said, according to Reuters.

Reuters was unable to immediately contact the Russian Embassy in Bucharest for comment. Moscow has repeatedly denied similar allegations.

Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as part of a wider sabotage campaign across Europe targeting defense manufacturing, according to AFP. For corporate leaders, that assessment expands the risk beyond isolated vandalism: production facilities, logistics infrastructure, communications systems and contractors may all form part of the same competitive and geopolitical landscape.

Romania’s exposure is particularly significant. The European Union and NATO member shares more than 600 kilometers of land border with Ukraine and occupies an important position in the regional defense and logistics network. Romanian President Nicușor Dan has previously said the country is a target of hybrid warfare conducted by Russia to destabilize states supporting Ukraine’s defense against Russian military aggression.

The alleged plot also follows an earlier cross-border investigation. A year ago, Poland and Romania detained eight people suspected of involvement in a Russian plan to send parcels containing explosives to Ukraine.

Recruitment Model Creates Management Challenges

SRI said operatives used social media to recruit people for sabotage. Recruits were initially offered money for apparently harmless assignments, such as observing or photographing selected sites. The tasks then became progressively more serious and could include vandalism, arson or even killings, the agency said.

That recruitment model presents an unusual challenge for corporate management because it can rely on individuals without an obvious intelligence background. Defense companies may therefore need to reassess how they monitor reconnaissance around facilities, control photography, vet temporary workers and contractors, protect sensitive production information and coordinate incident reporting with national authorities.

The Romanian investigation comes amid reports of an intensified campaign across NATO countries. The Wall Street Journal reported on October 20, citing three European officials familiar with US intelligence findings, that Russian President Vladimir Putin had personally ordered an expansion of sabotage operations against NATO states.

According to the newspaper, a failed drone attack at Germany’s Leipzig airport on August 4 was among the first operations in the campaign. After the incident, the Russian side allegedly used an unofficial communications channel to warn the German government that Leipzig would not be the final target, people familiar with the conversation told the newspaper.

The increase in covert operations coincided with a lack of significant Russian military advances in Ukraine and more frequent Ukrainian strikes against targets deep inside Russian territory, the report said.

European Producers Confront Operational Disruption

A series of incidents followed Leipzig. Drone-manufacturing businesses in Estonia and Poland were set on fire in August, while Slovak authorities reported preventing an arson attack against a similar production operation. Poland, Lithuania and Bulgaria also reported sabotage targeting ground stations used by the Starlink satellite system.

Western officials say the activity is organized by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit created after Russia began its military invasion of Ukraine. The department is led by Colonel General Andrei Averyanov. Western intelligence services also determined that Colonel Denis Smolyaninov, one of the unit’s senior officials, was involved in the Leipzig operation, according to The Wall Street Journal.

For Europe’s defense sector, the commercial implications extend beyond repair costs at any single plant. Disruption can delay deliveries, constrain capacity and complicate government procurement programs at a time of rising demand. The multinational nature of the alleged network and the arrests in Germany, the Romanian extradition effort and the Polish search also underline the need for coordinated security policies across corporate groups, suppliers and national jurisdictions.

The competitive advantage of European arms producers increasingly depends not only on manufacturing scale and technology, but also on their ability to keep plants operating under sustained hybrid pressure. The Carfil case suggests that resilience planning is moving from a compliance function to a central element of corporate strategy.