Adversary Intelligence — 2026-10-28

Romania's Intelligence Service Uncovers Russian Sabotage Network Behind Brasov Defense Plant Fire

BLUFRomania's exposure of a multi-target Russian sabotage network means Romarm and allied defense-industrial sites across Eastern Europe face persistent arson and disruption risk well beyond this single case.

Romania's Intelligence Service (SRI) said on Monday, October 26, that it identified a Russian-coordinated sabotage network behind the September 14 fire at the Carfil industrial platform in Brașov, beside a facility of state-owned defense firm Romarm 123. Prosecutors at DIICOT named two Belarusians and one Ukrainian, all residing in EU states, as suspects 14. Two were placed in custody in Germany while allegedly preparing similar acts, and a European arrest warrant was issued on October 26 for the third, located in Poland 23. SRI said the network's Russian coordinators assigned it other weapons-production targets 1; Al Jazeera reported that Moscow has previously denied such accusations and did not immediately comment 4. Romania's Interior Ministry has stepped up patrols at defense sites and critical infrastructure 3.

Analysis
Confidence is moderate: reporting is consistent on the October 26 warrant and the suspect's Polish location, but it is a narrow cluster of secondary outlets relaying the same SRI and DIICOT statements, with no corroboration beyond Romania's official channels, and none describes Warsaw's court timetable or the suspect's legal posture. The third suspect, located in Poland, will likely be taken into custody or surrendered to Romania under the European arrest warrant between October 28 and November 30, 2026. With two suspects already in German custody, Romania's next test is extradition sequencing among Germany, Poland and Bucharest, not attribution. The network's reported tasking against other weapons plants leaves Romarm and Western-supplier sites exposed, and the higher patrol tempo suggests Bucharest expects further attempts. The attribution may instead rest chiefly on Romanian claims that serve domestic and alliance signaling, and the network could be a loosely run criminal proxy whose Russian direction is asserted but not independently shown. A surrender would let prosecutors build a joint case with Germany and give EU partners a firmer basis to tighten site security, while a failure would mean a prolonged extradition dispute and an at-large operative who knows the network.

4 sources