SRI: 3 Suspects Linked to Romanian Arms Plant Arson

Romanian intelligence authorities have identified a sabotage network directed from Russia that attempted to ignite a fire at the Carfil arms factory in Brașov on September 14. The Romanian Intelligence Service (SRI) released a statement detailing the operation, which it described as part of a coordinated campaign of hybrid warfare targeting European defense infrastructure.

Investigators determined that three citizens of post-Soviet states, all legally residing in European Union countries, carried out the arson attempt. According to reports from Digi24, the suspects include two Belarusian citizens and one Ukrainian. Law enforcement officers detained two of the individuals in Germany, where they were preparing similar attacks, while the third was arrested in Poland. The Bucharest Court of Appeal has issued European arrest warrants for all three, and Romanian authorities have initiated extradition proceedings.

The SRI stated that the group’s scope of operations extended beyond Romanian borders. Russian handlers assigned the network targets across the region, specifically focusing on state-owned and private arms manufacturers and other sites of military and industrial importance. The service noted that investigations conducted this year have uncovered additional attempts against facilities in Romania, including international military sites and locations used to train Ukraine’s Armed Forces.

In its assessment, the intelligence service explained that these actions aim to intimidate European nations, undermine their defense capabilities, and weaken their contributions to regional security. The statement emphasized that recruitment for such operations typically occurs through social media platforms. Recruits are initially offered payment for simple tasks like monitoring or photographing specific sites. Assignments then escalate to acts of destruction, arson, or even murder. If recruits attempt to withdraw, handlers may use pressure or blackmail to compel compliance.

The networks exploit vulnerabilities such as financial instability, addiction, or prior criminal records. To obscure their identities and movements, members frequently use transport, accommodation, and payment methods registered in the names of others. Communication is maintained through SIM cards from third countries and encrypted messaging applications. The SRI stated that the Directorate for Investigating Organised Crime and Terrorism, the General Directorate for Defence Intelligence, and the Ministry of Internal Affairs are continuing joint investigations into sabotage operations detected within the country.

This case aligns with recent warnings from European leaders regarding increased Russian activity. Romanian President Nicușor Dan has cited a rise in Russian provocations across the European Union. Polish Prime Minister Donald Tusk recently indicated that intelligence suggests a potential escalation of Russia’s hybrid war against Europe before the Christmas season.