Romanian Fire Near Defense Plant Linked to Russia-Directed Sabotage Network
A September fire near the Carfil SA defense plant in Brașov, Romania, was linked by local intelligence to an agent network directed by Russian intelligence services. Three suspects — one Ukrainian citizen and two Belarusian citizens — were detained in the European Union as they reportedly prepared similar crimes. Ukrainian intelligence says Russia uses vulnerable Ukrainian refugees for sabotage across Europe.
Key points
- A fire occurred in September near the Carfil SA defense plant in Brașov, Romania.
- Romanian intelligence attributed the fire to an agent network directed by Russian intelligence services.
- The three suspects include one Ukrainian citizen and two Belarusian citizens; all were detained in the EU.
- About 200 Russia-linked sabotage incidents have been recorded in Europe since 2022, with Poland accounting for 21%.
- More than 170 perpetrators have been identified, including Ukrainians.
- Recruitment commonly occurs via social networks, messengers and job-search chats offering easy earnings or help with financial problems.
- Ukrainian intelligence exchanges information with European partners to identify recruitment channels and potential sabotage targets.
Why it matters
The allegations indicate that Ukrainian refugees in Europe can be covertly recruited for sabotage and then controlled through blackmail or threats of prosecution. Infrastructure and defense sites face attacks intended to intimidate Europeans, disrupt military aid to Ukraine and foster anti-Ukrainian sentiment. Poland has the largest reported share of incidents, while intelligence cooperation helps expose networks and protect potential targets.
What happened
In September, a fire broke out near the Carfil SA defense plant in Brașov, Romania. Romanian intelligence determined that the blaze was caused by an agent network directed by Russian intelligence services. Among three suspects in the suspected arson were a Ukrainian citizen and two Belarusian citizens. They were detained in the European Union, where they were apparently preparing similar crimes.
Ukrainian foreign intelligence said Russia uses vulnerable Ukrainian refugees in its hybrid campaign in Europe, seeking people who may be vulnerable to recruitment through social media, messaging apps and job-search chats promising quick earnings. The alleged goals are to intimidate Europeans, weaken military assistance to Ukraine and stir anti-Ukrainian sentiment. Polish rail lines, warehouses, logistics hubs and defense companies feature in most known Russian-linked sabotage cases, with Poland drawing particular attention because major aid routes to Ukraine cross its territory.
Recruitment typically starts with simple assignments such as photographing an object or placing stickers before escalating to surveillance, property damage, arson and sabotage. Performers are told to record results on video for their handler. Some may not know whom they work for and may receive no payment. After completing a task, they can face blackmail, further control, arrest and lengthy imprisonment.
How Ukrainian sources describe it
Ukrainian coverage focuses on the alleged recruitment of vulnerable Ukrainian refugees, the escalation from simple tasks to sabotage, and the risks of arrest or lengthy imprisonment. Ukrainian sources emphasize the stated Russian objectives of intimidating Europeans, weakening military support for Ukraine and encouraging anti-Ukrainian sentiment. They also highlight intelligence cooperation with European partners and warnings about suspicious offers of quick earnings.
Where reporting differs
Ukrainian intelligence directly attributes the Brașov fire and the wider sabotage campaign to agent networks directed by Russian intelligence services. Russia traditionally denies involvement in creating agent networks for hybrid operations in the European Union.
Background
Since 2022, about 200 sabotage incidents linked to Russia have been recorded in Europe. Poland accounts for 21% of them, and more than 170 perpetrators have been identified, including Ukrainians. Recruitment reportedly targets people experiencing poverty, residents of temporarily occupied territories, people with criminal backgrounds and teenagers seeking easy money. Ukrainian intelligence advises treating new contacts cautiously if they offer quick earnings, promise to solve financial problems, seek personal information or demand secrecy, and says people in suspicious situations should seek legal help from host-country law enforcement or Ukrainian diplomatic missions.