The Directorate for Investigating Organized Crime and Terrorism (DIICOT) and the Romanian Intelligence Service (SRI) announced on Monday that they have documented the criminal activity of three foreign nationals (two Belarusians and one Ukrainian) residing in EU member states, members of a sabotage network coordinated from the Russian Federation, who were involved in an explosion at the Carfil industrial site in Brasov, a subsidiary of Romarm.

'Investigations began in September 2026, when a fire broke out at an industrial site in the municipality of Brasov - located in the immediate vicinity of CARFIL SA, a subsidiary of ROMARM - affecting the premises of several commercial entities. The evidence gathered indicates that the three defendants, two Belarusian nationals and one Ukrainian national, are involved in the case. Consequently, judges at the Bucharest Court of Appeal issued European arrest warrants in absentia. Through international cooperation, two of the defendants were located and placed in pre-trial detention in Germany while preparing to carry out similar acts,' DIICOT stated in a press release.

On Monday, a third European arrest warrant was issued for another defendant, who has been located in Poland. Investigations are ongoing regarding the attempted commission of acts of sabotage, and the necessary steps are being taken to extradite the three defendants to Romania.

The DIICOT states that the criminal investigation has also revealed that the three defendants were targeting other facilities within Romania and other EU member states.

'In light of this incident at the industrial site in Brasov, which follows a recent series of similar events in Romania, heightening concerns regarding the security of industrial facilities and critical infrastructure, the DIICOT, the Ministry of Internal Affairs (MAI), and the Romanian Intelligence Service are continuing their investigation into the individuals involved. Given the current regional and European security climate, marked by the proliferation of hybrid warfare tactics, the evolution of asymmetric risks, which could potentially affect public order or strategic assets in Romania, is being continuously monitored,' DIICOT stated.

Separately, the Romanian Intelligence Service announced on Monday that, in cooperation with domestic and international partners, it has identified a sabotage network coordinated from the Russian Federation. This network was involved in causing the fire on September 14, 2026, at the Carfil industrial site in Brasov, located in the immediate vicinity of CARFIL SA, a subsidiary of the national company ROMARM.

'Investigations have confirmed the involvement of several citizens from former Soviet states who reside in European Union member states. Judicial proceedings are currently underway regarding their activities, both within Romania and in cooperation with authorities from various other European nations. Data obtained thus far indicates that the network's missions were not limited to Romania. Coordinators based in the Russian Federation had assigned it a wide range of targets across the region, including both state-owned and private arms manufacturing facilities, as well as other sites of military and industrial interest. This case is part of a broader campaign of sabotage operations orchestrated by the Russian Federation in Europe. Investigations conducted this year have also uncovered other attempts targeting sites in Romania, including international military facilities or locations used for the training of Ukrainian armed forces,' the SRI states.

According to the SRI, these actions are intended to intimidate, impair defense capabilities, and weaken the contribution of the targeted states to European and regional security.

'Recruitment for sabotage may begin with an offer of money for a seemingly harmless task. The SRI warns that such recruitment typically takes place via social media. Those approached are initially offered payment for specific, isolated activities, such as observing or photographing certain sites. Over time, the tasks become increasingly serious, potentially escalating to acts of destruction, arson, or even assassination. If an individual refuses, the handlers may resort to pressure and blackmail. These networks specifically exploit financial vulnerabilities, personal dependencies, or a history of criminal activity. To conceal their identities and movements, the individuals involved frequently use transport, accommodation, and payment methods registered to other people; they also rely on communication channels involving SIM cards from third countries and encrypted messaging applications. These factors must be assessed collectively and within their proper context; taken in isolation, they do not necessarily indicate that a person is involved in sabotage,' the Service states.

The SRI, in coordination with the DIICOT, the Ministry of National Defence, through the Defence Intelligence General Directorate, and the Ministry of Internal Affairs, continues to investigate sabotage operations identified within national territory. AGERPRES(RO - writing by: Eusebi Manolache; EN - writing by: Bogdan Gabaroi)