The Romanian Intelligence Service (SRI) announced on Monday, October 26, that it identified a sabotage network coordinated from Russia that was involved in causing the September 14 fire at the Carfil industrial platform in Brașov. Three suspected members of the network - two Belarusian citizens and one Ukrainian - are now wanted under European arrest warrants, DIICOT prosecutors said.
The fire broke out near Carfil SA, a subsidiary of Romanian state-owned defense company Romarm, and affected the premises of several businesses operating on the industrial platform.
“The investigations confirmed the involvement of several citizens of former Soviet states residing in European Union countries,” SRI said. “Judicial proceedings related to their activities are underway in Romania and in cooperation with authorities from several European states.”
The intelligence service also shared a video of the incident - here.
In their turn, Romania’s organized crime and terrorism prosecutors, DIICOT, said two of the suspects were located and placed in pretrial detention in Germany while allegedly preparing similar acts. A third European arrest warrant was issued on October 26 for another suspect, who was located in Poland.
The three are being investigated for attempted acts of sabotage, and Romanian authorities are seeking their extradition. DIICOT said evidence indicated that they had also targeted other facilities in Romania and elsewhere in the EU.
According to SRI, the alleged Russian coordinators had assigned the network a broader list of targets across the region, including state-owned and private weapons-production facilities and other military and industrial sites.
The intelligence service said the incident was part of a wider campaign of sabotage operations coordinated by Russia in Europe. Other alleged attempts identified in Romania this year targeted international military facilities and sites used to train Ukrainian forces.
“These actions aim to intimidate, damage defense capabilities, and weaken the targeted states’ contribution to European and regional security,” SRI said.
It also warned that recruitment for sabotage operations generally takes place through social media. Potential recruits may initially be offered money for apparently harmless tasks, such as observing or photographing facilities, before receiving more serious assignments involving destruction, arson, or even assassination.
According to the service, coordinators may resort to pressure and blackmail if recruits refuse to continue. Such networks often exploit financial vulnerability, addictions, or criminal records and may use transportation, accommodation, and payment methods registered to other people, phone cards from third countries, and encrypted messaging applications.
SRI stressed that these indicators must be assessed together and in context, as none of them individually proves involvement in sabotage.
SRI, DIICOT, the Interior Ministry, and the Defense Ministry’s General Directorate for Defense Intelligence are continuing the investigation in cooperation with international partners.
Back in early September, SRI announced that it prevented another sabotage operation allegedly coordinated by the Russian Federation on Romanian territory. The case involved a Russian citizen living in Romania who had been under surveillance since February 2026.
This investigation focused on attempted acts of disruption involving photographs and video recordings of communication centers and Romanian military bases used by NATO allies. The Russian citizen also allegedly documented buildings belonging to institutions within Romania’s national defense, public order, and national security system, as well as critical infrastructure.