Romanian intelligence links fire at Carfil industrial platform to Russian-coordinated sabotage network

The Romanian Intelligence Service (SRI) announced on Monday, October 26, that it identified a sabotage network coordinated from Russia that was involved in causing the September 14 fire at the Carfil industrial platform in Brașov. Three suspected members of the network - two Belarusian citizens and one Ukrainian - are now wanted under European arrest warrants, DIICOT prosecutors said.

The fire broke out near Carfil SA, a subsidiary of Romanian state-owned defense company Romarm, and affected the premises of several businesses operating on the industrial platform.

“The investigations confirmed the involvement of several citizens of former Soviet states residing in European Union countries,” SRI said. “Judicial proceedings related to their activities are underway in Romania and in cooperation with authorities from several European states.”

The intelligence service also shared a video of the incident - here.

In their turn, Romania’s organized crime and terrorism prosecutors, DIICOT, said two of the suspects were located and placed in pretrial detention in Germany while allegedly preparing similar acts. A third European arrest warrant was issued on October 26 for another suspect, who was located in Poland.

The three are being investigated for attempted acts of sabotage, and Romanian authorities are seeking their extradition. DIICOT said evidence indicated that they had also targeted other facilities in Romania and elsewhere in the EU.

According to SRI, the alleged Russian coordinators had assigned the network a broader list of targets across the region, including state-owned and private weapons-production facilities and other military and industrial sites.

The intelligence service said the incident was part of a wider campaign of sabotage operations coordinated by Russia in Europe. Other alleged attempts identified in Romania this year targeted international military facilities and sites used to train Ukrainian forces.

“These actions aim to intimidate, damage defense capabilities, and weaken the targeted states’ contribution to European and regional security,” SRI said.

It also warned that recruitment for sabotage operations generally takes place through social media. Potential recruits may initially be offered money for apparently harmless tasks, such as observing or photographing facilities, before receiving more serious assignments involving destruction, arson, or even assassination.