Romania Uncovers Alleged Russian Plot Targeting Arms Production

Romania’s domestic intelligence service says it has uncovered a Russian-coordinated sabotage network that attempted to set fire to the Carfil weapons plant in Brașov, placing another European defense manufacturer at the center of an alleged campaign against the continent’s military-industrial capacity.

The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network was “directly coordinated by the intelligence services of the Russian Federation.” According to the agency, the group attempted the attack on September 14 at Carfil’s facility in the central Romanian city.

“The coordinators in the Russian Federation identified an extensive list of targets in the region for the group: state-owned and private arms manufacturers, as well as other sites of military and industrial interest,” SRI said in a statement quoted by Reuters.

Reuters was unable to obtain an immediate response from the Russian Embassy in Bucharest. Moscow has repeatedly denied comparable allegations made by European governments.

Defense factories become economic pressure points

The alleged operation illustrates how individual factories can become strategic pressure points as European governments seek to expand weapons production and replenish inventories depleted by military support for Ukraine. An attack need not destroy an entire facility to impose significant costs. Even a limited fire can interrupt production, prompt safety inspections, delay deliveries and force companies to spend more on security.

Such disruption can spread through a defense supply chain because weapons manufacturers depend on specialized components, certified production processes and a relatively narrow pool of skilled labor. Capacity lost at one plant may therefore be difficult to replace quickly elsewhere. The economic consequences can include higher procurement costs for governments, longer delivery schedules and greater uncertainty for private contractors considering investments in new production lines.

The suspects identified in the Romanian case include two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while allegedly preparing similar acts of sabotage, while the third is wanted in Poland, Romanian television channel Știri reported. Bucharest is seeking their extradition to Romania.

The investigation follows an earlier multinational case. A year ago, authorities in Poland and Romania detained eight people suspected of involvement in a Russian plan to send parcels containing explosives to Ukraine.

Romania’s exposure is shaped by geography as well as industrial policy. The European Union and NATO member shares a land border of more than 600 kilometers with Ukraine. Romanian President Nicușor Dan has previously said the country is a target of hybrid warfare conducted by Russia to destabilize states supporting Ukraine’s defense against Russian military aggression.

Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as “part of a broader sabotage campaign across Europe” directed against defense production, according to AFP.

Low-cost recruitment, potentially high economic damage

SRI said organizers commonly recruit participants through social media, initially offering money for apparently harmless assignments such as observing or photographing particular sites. The gradual escalation of tasks can make recruitment inexpensive and difficult to detect at an early stage.

“Subsequently, the assignments become increasingly serious and may include acts of vandalism, arson or even murder,” the intelligence service said.

From an economic perspective, that model is highly asymmetric: recruiters may spend relatively little while compelling governments and companies to absorb substantial security, insurance and compliance costs. If threats are perceived as persistent, European manufacturers may need to protect factories, warehouses, transport routes, communications infrastructure and key personnel simultaneously.

The Romanian allegations form part of a wider pattern reported by Western officials and media. On October 20, The Wall Street Journal, citing three European officials familiar with US intelligence assessments, reported that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO countries. The newspaper said an unsuccessful drone attack at Germany’s Leipzig airport on August 4 was among the first actions in the campaign.

Following that incident, the Russian side reportedly warned the German government through an unofficial communications channel that Leipzig would not be the final target, according to people familiar with the conversation. The reported increase in covert operations coincided with a lack of significant Russian military advances in Ukraine and more frequent Ukrainian strikes on targets deep inside Russian territory.

A series of incidents elsewhere in Europe followed Leipzig. Drone-manufacturing businesses in Estonia and Poland were set on fire in August, while Slovak authorities reported preventing an arson attack against similar production. Poland, Lithuania and Bulgaria also reported sabotage involving ground stations for the Starlink satellite system.

Western officials say the activity is organized by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit created after the invasion of Ukraine began. It is led by Colonel General Andrei Averyanov. Western intelligence services also determined that Colonel Denis Smolyaninov, one of the unit’s senior figures, was involved in the Leipzig operation, according to the Journal.

The immediate question for Romania is whether the suspects can be extradited and prosecuted. The larger economic issue for Europe is whether repeated attacks, attempted attacks and threats can slow the expansion of defense output. Historically, industrial mobilization has depended not only on factory capacity but also on secure logistics, reliable energy and public confidence. The alleged campaign suggests that protecting those foundations is becoming an integral cost of Europe’s defense buildup.