SRI has identified a sabotage network coordinated from the Russian Federation, involved in starting the fire at the Carfil industrial site

October 26, 2026

The Romanian Intelligence Service, in cooperation with domestic and foreign partners, has identified a sabotage network coordinated from the Russian Federation that was involved in starting the fire on September 14, 2026, at Carfil industrial site in Brașov, in the immediate vicinity of CARFIL SA, a subsidiary of CN ROMARM.

Investigations have confirmed the involvement of several citizens of former Soviet states who are residing in EU member states. Judicial proceedings concerning their activities are underway in Romania and in cooperation with authorities in several European countries.

Information obtained so far indicates that the network’s missions were not limited to Romania. Its coordinators in the Russian Federation had assigned it a wide range of targets across the region: state- owned and private weapons production facilities, as well as other targets of military and industrial importance.

This case is part of a broader campaign of sabotage operations coordinated by the Russian Federation in Europe. Investigations conducted this year have also identified other attempts targeting sites in Romania, including international military facilities and facilities used to train the Ukrainian armed forces.

These actions aim to intimidate, undermine defense capabilities, and weaken the targeted countries’ contribution to European and regional security.

Recruitment for sabotage may begin with an offer of money for a seemingly harmless task.

SRI warns that recruitment generally takes place through social media. Those approached are initially offered money for specific tasks, such as observing or photographing certain sites. The tasks subsequently become increasingly serious, potentially escalating to property destruction, arson, or even assassination. In the event of a refusal, the coordinators may resort to pressure and blackmail.

These networks particularly exploit financial vulnerabilities, addictions, or criminal records. To conceal their identities and movements, the members frequently use transportation, accommodation, and payment methods registered in other people’s names, as well as SIM cards from third countries and encrypted messaging applications.

These elements must be evaluated together and in context; taken separately, they do not indicate a person’s involvement in acts of sabotage.

SRI, together with the Directorate for Investigating Organized Crime and Terrorism (DIICOT), the Ministry of National Defense - the Defense Intelligence General Directorate, and the Ministry of Internal Affairs, is continuing its investigation regarding acts of sabotage identified in Romania.

The Romanian Intelligence Service works in cooperation with national, European, and transatlantic partners to identify and counter these threats, protect targeted sites, and inform the public about the methods used by sabotage networks.