Adversary Intelligence — 2026-11-08

Ukrainian Intelligence Exposes GRU and FSB Network Recruiting Saboteurs Against European Defense Industries

BLUFMoscow's low-cost, deniable sabotage model will keep straining European counterintelligence resources while exploiting refugee populations in ways that complicate allied cohesion and aid logistics to Ukraine.

Ukraine's Foreign Intelligence Service stated in a statement carried by Ukrinform and UNN that around 200 Russia-linked sabotage acts have been recorded in Europe since 2022, with Poland accounting for 21% and more than 170 perpetrators identified, including Ukrainians 12. The service stated Romanian intelligence traced a September arson near the Carfil SA defense plant in Brașov to a Russian-directed network; suspects are one Ukrainian and two Belarusians, detained elsewhere in the EU 12. It stated handlers recruit vulnerable refugees through social media and job-search groups, escalating from photographing sites to arson and requiring video proof 1. CiberCuba, citing InformNapalm, reported over 180 incidents and a GRU-linked network coordinated by Cuban national Oemis Romagoza Durruthy, for whom a Bucharest court issued an arrest warrant on November 2 3.

Analysis
European security services will continue diverting counterintelligence and site-protection resources to a sabotage model Moscow runs cheaply through disposable, deniable recruits, with Poland's rail, logistics and defense sites most exposed because the Kremlin targets the flow of military aid to Ukraine. Recruiting Ukrainian refugees gives handlers an alibi and feeds anti-refugee sentiment, pressing host governments to screen these communities without alienating them. The Carfil arson shows the network crossing borders, with mixed-nationality suspects detained outside Romania. Attribution has moved beyond the Slovak drone-factory plot, which had no traceable sponsor, to Ukrainian naming of GRU and FSB direction. Confidence is low: everything traces to one Ukrainian service statement, the roughly 200-incident count is unconfirmed, and the Cuban-network account rests on one outlet. Kyiv may be inflating the count and Russian direction to sustain aid and protect refugees' standing, and some acts may be freelance criminal opportunism.

3 sources