Allied Intelligence — 2026-09-10

Romanian Intelligence Service Detains Russian Citizen in Joint Operation to Prevent Sabotage of Military and NATO Installations

BLUFRomania's detention of a Russian citizen surveilling NATO bases and Ukrainian cargo flights confirms an active, persistent Russian collection network targeting allied logistics corridors into Ukraine.

Romania's Intelligence Service (SRI) said on Tuesday it worked with DIICOT, the Interior Ministry, military intelligence and unnamed foreign partners to prevent a sabotage plot involving a 40-year-old Russian citizen resident in Romania 1. SRI said the man had been under surveillance since February and, per DIICOT, photographed and transmitted images of Romanian and allied military equipment and troop movements at bases in Cluj, Constanța, Călărași, Ilfov and Bucharest between February and July, acting under an intermediary's direction via encrypted messaging 1. He also filmed Ukrainian Antonov cargo aircraft present in Romania 12. DIICOT prosecutors detained him on September 8 on a charge of attempted sabotage, and the Bucharest Court of Appeal ordered 30 days' pretrial arrest that evening 1. SRI said the man's methods matched patterns used elsewhere in Europe by networks it attributes to Russian coordination, including cases disrupted in Romania in 2024 and 2025; Romanian authorities have not publicly named the suspect or released evidence of direct Russian state involvement 12. Meduza, citing Newsweek Romania and leaked records reviewed by Agentstvo, identified the detainee as Ivan Kutsenko of Novosibirsk, previously named in a 2009 Russian robbery case, who traveled to Romania and Moldova between 2019 and 2021 and to Turkey after Russia's 2022 invasion of Ukraine 3.

Analysis
SRI's explicit linkage of this case to disrupted 2024 and 2025 networks confirms Romania as an active node in a persistent, Russian-coordinated surveillance campaign against NATO logistics rather than an isolated recruitment. Targeting of Antonov cargo flights shows Russian interest in tracking Western materiel transiting toward Ukraine beyond the front line. Sourcing rests almost entirely on a single SRI/DIICOT release carried by Digi24, with other outlets echoing that statement rather than independently verifying it, apart from Meduza's separate identification of the suspect as Ivan Kutsenko of Novosibirsk. Romanian authorities' refusal to name him or disclose evidence of direct state control leaves open that this was a lower-tier operative directed via encrypted messaging by an intermediary rather than a formally controlled sabotage cell. The network's recruitment pathway and command structure remain unconfirmed.

4 sources