Romania’s intelligence service says a Russian-run sabotage network set the 14 September fire at the Carfil arms platform in Brașov

Romania’s Intelligence Service (SRI) said on 26 October that a fire on 14 September at the Carfil industrial platform in Brașov, next to CARFIL SA, a subsidiary of the state arms group ROMARM, was caused by a sabotage network coordinated from the Russian Federation. The service said it is part of a wider Russian sabotage campaign in Europe.

What SRI says

According to the SRI statement, investigations confirmed the involvement of several citizens of former Soviet states who live in EU countries. Judicial proceedings are under way in Romania and, with the authorities of several European states, abroad. SRI did not name the suspects or announce arrests in its release. Russia had not commented immediately, Al Jazeera reported, adding that Moscow has previously denied such accusations.

The service said the network’s tasks were not limited to Romania: Russian coordinators assigned it a long list of regional targets, including state and private armament factories and other military and industrial sites. SRI added that other attempts this year targeted sites in Romania including international military facilities and facilities used to train Ukrainian forces. It is working with the anti-organised-crime directorate DIICOT, the defence intelligence directorate of the Ministry of National Defence and the Interior Ministry.

Al Jazeera, citing DIICOT, reported that three people were involved, two Belarusians and a Ukrainian living in EU countries. Two were arrested and held in Germany while preparing similar offences, and the third remains at large in Poland. That detail comes from Al Jazeera’s account of DIICOT’s statement and was not in the SRI release read for this article.

How recruits are approached

SRI said recruitment usually happens through social media. People approached “are initially offered money for one-off activities” such as observing or photographing sites, and the tasks then escalate to destruction, arson or even murder. “If someone refuses, the coordinators may resort to pressure and blackmail,” the statement said. Targets are often people with financial problems, dependencies or criminal records. The service cautioned that the indicators it listed, such as travel, lodging and payments registered in other people’s names, foreign prepaid SIM cards and encrypted messaging apps, “must be assessed together and in context”, and do not alone show involvement in sabotage.

Official reaction

President Nicușor Dan said Romania is a target of Russian hybrid war, citing drone incursions, cyberattacks, disinformation and sabotage, according to Al Jazeera. Foreign Minister Dan Neculăescu wrote on X: “Hybrid attacks will not hold us back from strengthening our resilience and defense.”

A Greek link to the Brașov site

CARFIL is the Romanian partner in a recent Greek-Romanian industrial project. Geopolitiki reported that Greece’s ALTUS LSA signs a memorandum with Romania’s CARFIL (ROMARM) on interceptor-drone munitions and joint production in Romania. The sources read for this article do not say whether that project is affected by the fire.

The case follows other European incidents. Geopolitiki reported that Bundeswehr: threat of Russian sabotage now rated “significant” – explosives-laden drone found near the Wunstorf air base.

Sources read: SRI press release, 26 October 2026; Al Jazeera, 27 October 2026, for the DIICOT details, the reaction of Romanian officials and Russia’s non-response.