Romania Detains Three Suspects in Russian-Linked Arms Factory Arson Plot
European arrest warrants were issued for two Belarusians and one Ukrainian linked to a September attack on a Brașov defense plant.
By Petra Murphy ·
Romania has issued European arrest warrants for three suspects in a sabotage network that attempted to burn down the Carfil arms factory in Brașov on September 14. The Romanian Intelligence Service, SRI, confirmed the group was coordinated by handlers in Moscow. This operation marks a specific escalation in coordinated efforts to target European defense infrastructure.
The suspects are two citizens of Belarus and one citizen of Ukraine. All three held legal residence in European Union member states prior to their arrests. German law enforcement detained two of the individuals while they were preparing additional crimes within that country. Police in Poland captured the third suspect. Romanian authorities have initiated extradition proceedings to bring all three before Romanian courts.
The SRI stated that the group’s mandate extended beyond the Brașov incident. Russian intelligence assigned the network multiple targets across the region. These included state-owned and private manufacturers of weapons systems as well as other sites of military and industrial value. The service characterized this case as one component of a wider campaign of sabotage operations currently active across Europe.
Investigations conducted during 2026 have identified other attempted attacks on facilities in Romania. These targets included international military sites and training grounds used by the Armed Forces of Ukraine. The intelligence service warned that such actions aim to intimidate national defense structures and weaken the contribution of European states to regional security.
Recruitment for these networks typically occurs through social media platforms. Initial tasks involve low-risk activities such as monitoring locations or taking photographs. Handlers then escalate assignments to include arson, destruction, or murder. Recruits who refuse further tasks often face pressure or blackmail. The networks frequently exploit candidates with financial vulnerabilities, addictions, or prior criminal records.
To obscure their movements, members of the network use transport, accommodation, and payment methods registered under third-party names. They communicate using SIM cards from countries other than their residence and encrypted messaging applications. The SRI is continuing its investigation alongside the Directorate for Investigating Organised Crime and Terrorism, the General Directorate for Defence Intelligence, and the Ministry of Internal Affairs.
Polish Prime Minister Donald Tusk recently indicated that intelligence suggests a potential escalation of Russia's hybrid war against Europe before Christmas. Romanian President Nicușor Dan also pointed to an increase in Russian provocations throughout the European Union. The current case adds concrete evidence to those assessments regarding the reach of these operations.
