Romania Uncovers Alleged Russian Plot Targeting Carfil Arms Plant
The suspected sabotage network raises new security and governance risks for European defense manufacturers and their boards.
Romania’s domestic intelligence service said it had uncovered a Russian-coordinated sabotage network linked to an attempted arson attack at the Carfil weapons plant in Brașov, exposing a widening operational threat to Europe’s defense industry.
The Romanian Intelligence Service, known as SRI, said on Monday, October 26, that the network was “directly coordinated by the intelligence services of the Russian Federation.” According to the agency, the group attempted on September 14 to set fire to the Carfil manufacturing facility in Brașov, a city in central Romania.
The suspects include two Belarusian citizens and one Ukrainian citizen. Two were detained in Germany while allegedly preparing similar acts of sabotage, while the third is wanted in Poland, Romanian broadcaster Știri reported. Authorities in Bucharest are seeking their extradition to Romania.
Defense companies face a broader campaign
SRI said the alleged Russian coordinators had identified numerous potential targets across the region, extending well beyond a single Romanian factory.
“The coordinators from the Russian Federation established an extensive list of targets for the group in the region: state-owned and private arms manufacturers, as well as other sites of military and industrial interest,” the intelligence service said in a statement quoted by Reuters.
Reuters said it was unable to immediately reach the Russian Embassy in Bucharest for comment. Moscow has repeatedly rejected similar allegations.
For European defense companies, the Romanian case points to a threat that reaches beyond conventional cybersecurity and espionage. Executives and boards may now have to treat physical sabotage, contractor screening, perimeter surveillance and employee recruitment through social media as interconnected enterprise risks. The inclusion of both state-owned and privately operated weapons producers on the reported target list also suggests that ownership structure offers little insulation from the campaign alleged by Romanian authorities.
Romanian Foreign Minister Dan Nicolaescu described the Brașov fire as “part of a broader sabotage campaign across Europe” directed against defense production, according to AFP. The allegation arrives as European governments and manufacturers seek to sustain weapons output for national requirements and continued support for Ukraine.
A year earlier, Poland and Romania detained eight people suspected of involvement in a Russian plan to send parcels containing explosives to Ukraine. The latest investigation therefore adds to an established pattern of alleged cross-border operations involving logistics networks, industrial sites and individuals working across several European jurisdictions.
Recruitment model creates compliance challenges
SRI said operatives involved in such activities are typically recruited through social media. Initial approaches may offer payment for an apparently harmless assignment, such as monitoring or photographing specified locations. The work then escalates in severity.
“Subsequently, the tasks become increasingly serious and may include acts of vandalism, arson or even murder,” SRI said.
That recruitment model has direct implications for corporate leadership. A person conducting surveillance outside a factory may initially appear to pose a limited security concern, but Romanian intelligence officials describe such activity as a possible first stage in a structured escalation. Defense-sector boards may consequently face pressure to review how physical-security incidents are reported, shared with national authorities and incorporated into corporate risk assessments.
Romania is a member of both the European Union and NATO and shares a land border of more than 600 kilometers with Ukraine. Romanian President Nicușor Dan has previously said the country is a target of Russian hybrid warfare intended to destabilize states supporting Ukraine’s defense against Russian military aggression.
Incidents spread across European industrial sites
The Romanian disclosure follows reports of a broader increase in covert operations. On October 20, The Wall Street Journal reported, citing three European officials familiar with US intelligence assessments, that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO countries.
According to the newspaper, an unsuccessful drone attack at Germany’s Leipzig airport on August 4 was among the first actions in the alleged campaign. After that incident, the Russian side reportedly used an unofficial communications channel to warn the German government that Leipzig would not be the final target. The account was attributed to people familiar with the conversation.
The reported intensification of covert activity coincided with a lack of significant Russian military advances in Ukraine and an increase in Ukrainian strikes against targets deep inside Russian territory.
A series of further incidents followed Leipzig. Drone-manufacturing facilities in Estonia and Poland were set on fire in August, while Slovak authorities reported preventing an arson attack against a similar production site. Poland, Lithuania and Bulgaria also reported acts of sabotage targeting ground stations for the Starlink satellite system.
Western officials believe the sabotage activity is organized by the Special Tasks Department of the Main Directorate of the General Staff of the Russian Armed Forces, a unit established after Russia began its full-scale military invasion of Ukraine. The department is headed by Colonel General Andrei Averyanov. Western intelligence services also determined that Colonel Denis Smolyaninov, identified as one of the unit’s senior officers, was involved in the Leipzig operation, according to the Journal.
The expanding list of alleged targets makes industrial resilience a boardroom issue rather than solely a matter for plant-level security teams. European defense manufacturers must protect production continuity while managing multinational supply chains, sensitive facilities and a threat environment that authorities say increasingly relies on inexpensive recruitment and deniable local operatives.
