Romania links Russia-coordinated sabotage network to Brașov Carfil fire

The fire and the investigation

Prosecutors say a fire on an industrial platform in Brașov on 14 September 2026 is linked to a sabotage network. The platform lies right next to CARFIL SA, a subsidiary of CN ROMARM, and the blaze damaged the premises of several commercial companies. The Directorate for Investigating Organised Crime and Terrorism (DIICOT), with informational support from the Romanian Intelligence Service (SRI), opened its inquiry that month. Investigators identified three foreign nationals, two Belarusian citizens and one Ukrainian citizen, all residents of European Union states. They are under investigation for attempted sabotage, and the Bucharest Court of Appeal issued in absentia European arrest warrants against them.

Arrests in Germany and Poland

Two of the suspects were remanded in custody in Germany through international judicial cooperation, and according to investigators they were preparing similar acts when they were found. The third suspect was located in Poland, and a European arrest warrant for him was issued on 26 October 2026. Romanian authorities are now pursuing the steps needed to extradite all three to Romania. DIICOT said the investigation is continuing into attempted sabotage and that the suspects also targeted other objectives in Romania and other EU states.

“The criminal investigation files show that the three defendants also targeted other objectives on Romanian territory and in other EU states.”

SRI's account of Russian coordination

The Romanian Intelligence Service announced on 26 October 2026 that it had identified a sabotage network coordinated from the Russian Federation, working with domestic and foreign partners. SRI said its investigations confirmed the involvement of several citizens of former Soviet states who live in EU states, and that legal proceedings are underway in Romania and with authorities in several European countries.

“The data obtained so far show that the network's missions were not limited to Romania.”

According to SRI, Russian coordinators assigned the network a broad set of targets in the region, including state and private armament production facilities and other military and industrial sites. The agency said the case fits a wider campaign of sabotage operations coordinated by Russia in Europe. It also said other attempts this year targeted Romanian sites, including international military facilities and facilities used to train Ukrainian armed forces, with the aim of intimidation and weakening the defence capabilities of the targeted states.

How recruitment works

SRI warned that recruitment usually takes place through social networks. People approached are first offered money for simple tasks such as watching or photographing a site, and the assignments then escalate to destruction, arson or even assassination. If a recruit refuses, the coordinators may resort to pressure and blackmail. The networks exploit financial vulnerabilities, dependencies and prior criminal records, and their members hide their identities and movements by using transport, accommodation and payment methods registered in other people's names.

Wider European pattern

The case comes against a backdrop of similar warnings elsewhere in Europe. In September, Danish counterintelligence warned that Russia was recruiting Danish citizens to help plan sabotage against Danish defence companies with ties to Ukraine. In October, the head of British counterintelligence warned that Russia was amplifying its hybrid war against Ukraine's allies and described Russia as the number one aggressor. Russia denies being involved in hostile actions in Western countries despite growing accusations.