Romania detains Russian citizen over suspected sabotage plot targeting NATO bases and cargo aircraft

Surveillance and detention

On 8 September 2026, Romanian security agencies announced the detention of a 40-year-old Russian citizen residing in Romania on suspicion of carrying out espionage and preparing a sabotage operation coordinated by Russian entities. The Romanian Intelligence Service (SRI) confirmed that security officials had kept the suspect under continuous surveillance since February 2026 as part of an extensive inquiry into foreign subversion. Prosecutors from Romania's Directorate for Investigating Organized Crime and Terrorism (DIICOT) subsequently submitted a formal request to hold the individual in provisional custody for 30 days.

The operation was executed through close cooperation between the SRI, DIICOT, the Directorate for Combating Organized Crime within the Romanian Police (MAI-DCCO), and the General Directorate for Defense Intelligence (MApN-DGIA). Foreign partner intelligence services also contributed operational support to the joint mission. Romanian authorities stated that the coordinated intervention succeeded in preventing a planned act of sabotage on national territory.

Reconnaissance of NATO bases and Ukrainian transports

According to investigative findings released by the SRI, the suspect collected photographic and video material documenting strategic installations, communication hubs, and national defense institutions. The reconnaissance activities focused heavily on military bases used by NATO allies, where the operative filmed stationed personnel, logistical movement, and defense equipment.

The surveillance operations covered multiple regions across Romania, including the counties of Cluj, Constanța, Călărași, and Ilfov, along with sensitive locations in and around the capital city of Bucharest. Investigators established that the suspect operated under instructions from a remote intermediary, with specific directives to record Ukrainian Antonov cargo aircraft present on Romanian soil. The SRI noted that the recruitment strategy relied on exploiting vulnerable individuals for covert tasks.

The investigation also revealed that the Russian Federation continues to use people belonging to vulnerable categories to carry out this type of illegal activity.

Pattern of European sabotage networks

The SRI stated that the suspect's operational methods match an established pattern previously identified across European countries, where networks coordinated by Russian entities carry out intelligence collection and sabotage preparations. The agency noted that the case closely resembles earlier operations foiled inside Romania in 2024 and 2025, when a Russian operative was similarly directed through an intermediary to document critical military targets and Ukrainian transport aviation.

European allies supporting Ukraine have repeatedly reported an increase in coordinated hybrid operations directed against critical infrastructure and defense supply corridors. The Russian government has consistently denied any involvement in sabotage plots across Europe. Following the announcement by Romanian authorities on Tuesday, the Russian embassy in Bucharest did not respond to requests for comment regarding the detention.

Custody and ongoing judicial inquiry

Judicial authorities confirmed that the 40-year-old suspect remains subject to a 30-day preventive detention measure while DIICOT prosecutors review confiscated technical equipment, photographic files, and video recordings. Specialised cyber and counter-intelligence teams are examining the communication channels used between the suspect and the handler who issued the operational tasks.

The investigation remains open under the supervision of Romanian judicial and military intelligence authorities in coordination with international security partners. Officials are assessing whether additional infrastructure sites were photographed and continuing efforts to identify the broader intermediary network operating behind the foiled plot.