Romania Uncovers Alleged Russian Plot Targeting Arms Production

Romania’s domestic intelligence service said it had uncovered a Russian-coordinated sabotage network that previously attempted to set fire to an arms manufacturing facility, raising broader concerns about the security of NATO’s European defense-industrial base.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network was “directly coordinated by the intelligence services of the Russian Federation.” According to the agency, the group tried on September 14 to ignite a fire at the Carfil weapons plant in Brașov, a city in central Romania.

“Coordinators in the Russian Federation identified an extensive list of targets for the group in the region: state and private arms manufacturers, as well as other sites of military and industrial interest,” the intelligence service said.

Reuters was unable to immediately reach the Russian Embassy in Bucharest for comment. Moscow has repeatedly denied similar accusations, according to the report.

Security risks for NATO supply chains

The allegations have implications beyond Romania. As Washington encourages NATO members to strengthen military production and sustain support for Ukraine, attempted attacks on European factories could disrupt suppliers serving a defense market closely connected to US contractors, government procurement programs and transatlantic logistics networks.

The list of suspects includes two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while allegedly preparing similar acts of sabotage, while the third is wanted in Poland, Romanian television channel Știri reported. Bucharest is seeking their extradition to Romania.

The case follows an earlier cross-border investigation. A year ago, Poland and Romania detained eight people suspected of involvement in an alleged Russian plan to send packages containing explosives to Ukraine.

Romania is a member of both NATO and the European Union and shares a land border of more than 600 kilometers with Ukraine. Romanian President Nicușor Dan has previously said the country is a target of hybrid warfare conducted by Russia to destabilize nations supporting Ukraine’s defense against Russian military aggression.

Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as “part of a broader sabotage campaign across Europe” directed against defense production, according to AFP. For US policymakers, the accusation adds to questions about whether existing NATO counterintelligence, infrastructure protection and law-enforcement coordination are sufficient to secure an expanding industrial network.

Recruitment through social media

SRI said operatives involved in such schemes are commonly recruited through social media. Prospective recruits are initially offered money for an apparently harmless assignment, such as watching or photographing particular locations.

“Subsequently, the tasks become increasingly serious and may include acts of vandalism, arson or even murder,” the Romanian service said.

That recruitment model presents a relatively low-cost threat to companies because it can turn individuals without an obvious intelligence background into intermediaries for attacks. For American businesses with factories, suppliers, data infrastructure or logistics operations in Europe, the Romanian account underscores the importance of physical security, employee awareness and coordination with local authorities. Those considerations are particularly relevant to firms connected to defense manufacturing or facilities of military and industrial interest.

The Wall Street Journal reported on October 20, citing three European officials familiar with US intelligence assessments, that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO countries. According to the newspaper, a failed drone attack at Germany’s Leipzig airport on August 4 was among the first operations in that campaign.

After the incident, the Russian side used an unofficial communications channel to warn the German government that Leipzig would not be the final target, the newspaper reported, citing people familiar with the conversation. The increase in covert operations coincided with a lack of significant Russian battlefield gains in Ukraine and more frequent Ukrainian military strikes against sites deep inside Russian territory.

Incidents spread across Europe

A series of additional incidents followed Leipzig. Drone-manufacturing facilities in Estonia and Poland were set on fire in August. Slovak authorities reported during the same period that they had prevented an arson attack against a similar production site. Poland, Lithuania and Bulgaria also reported sabotage involving ground stations for the Starlink satellite system.

Western officials believe the activity is organized by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit created after the start of Russia’s military invasion of Ukraine. The department is headed by Colonel General Andrei Averyanov.

Western intelligence services also determined that Colonel Denis Smolyaninov, identified as one of the unit’s senior officials, was involved in the Leipzig operation, according to the Journal.

The widening pattern is likely to attract attention in Washington because the resilience of Europe’s arms factories and transportation infrastructure affects NATO readiness and the durability of Western support for Ukraine. Although the reported targets are in Europe, production disruptions could carry financial and operational consequences for US defense companies whose supply chains, partnerships and customers span the Atlantic.