---
title: "Romania Ties Arson at Mortar-Ammo Plant to a Three-Man Russian Cell"
description: "SRI says the September Brasov fire fits a target list of arms factories across the region, part of a campaign no two trackers count the same way"
author: "Luis Goa"
published: 2026-10-27T00:33:06Z
modified: 2026-10-27T10:40:33Z
url: https://rews.cc/a/romania-ties-arson-at-mortar-ammo-plant-to-a-three-man-russi-1eff9c
language: en
tags: ["war", "sabotage", "russia", "ukraine", "nato", "europe", "mideast"]
publisher: "Rews (https://rews.cc)"
---

# Romania Ties Arson at Mortar-Ammo Plant to a Three-Man Russian Cell

*SRI says the September Brasov fire fits a target list of arms factories across the region, part of a campaign no two trackers count the same way*

By Luis Goa · October 27, 2026 · https://rews.cc/a/romania-ties-arson-at-mortar-ammo-plant-to-a-three-man-russi-1eff9c

## In brief

- Romania’s SRI says a Russia-coordinated cell set the Sept 14 fire near Brasov’s Carfil mortar-ammunition plant
- Three suspects - two Belarusians, one Ukrainian - face DIICOT sabotage charges; two held in Germany, one tracked to Poland
- SRI says the network’s target list covered state and private arms factories across the region, not just Carfil
- The case echoes 2026 arson attributed to Russia at Estonia’s Milrem Robotics, Bulgaria’s EMCO depots and Poland’s WB Electronics
- Trackers disagree sharply on the campaign’s scale: counts range from 54 verified incidents since April to 163 internal German cases

Carfil SA, in Brasov, is Romania’s main supplier of RPG-7 rounds and of 60mm, 81mm and 82mm mortar bombs to its own army, and has built NATO-standard ammunition since 2005. On September 14, 2026, a fire broke out inside the industrial park that surrounds the plant. Six weeks later, on October 26, Romania’s domestic intelligence service, the SRI, said in a statement carried by [Agerpres](https://agerpres.ro/comunicate/2026/10/26/comunicat-de-presa---serviciul-roman-de-informatii--1607028) that the fire was no accident: it was set by a three-man cell the agency says was run from Russia, as [Al Jazeera reported](https://www.aljazeera.com/news/2026/10/27/romania-says-russia-run-sabotage-network-set-fire-near-weapons-factory).

Carfil has made weapons since 1936 and became a [subsidiary of the state conglomerate ROMARM](https://romarm.ro/en/informatii-despre-companie/filiale-romarm/carfil/) in 2001, one of 15 factories under that umbrella. Since 2025 it has also built military drones with the US firm Periscope Aviation. None of that makes it unique among Europe’s defence plants, which is the point: SRI says its attackers were handed a list of such plants, not a single target.

DIICOT, Romania’s organised-crime and terrorism prosecution unit, is investigating three men for attempted acts of sabotage: two Belarusian citizens and one Ukrainian, all residents of European Union states. Two were caught in Germany, where investigators say they were preparing similar attacks; the third was tracked to Poland. The Bucharest Court of Appeal issued in-absentia European arrest warrants for all three, the last one on October 26, the same day SRI went public.

## How the network recruits

SRI’s account of its own tradecraft is more specific than most such statements. Recruitment starts on social media, with payment offered for a low-risk task, such as photographing or watching a site. Compliant recruits get escalating assignments running up to, in SRI’s wording, vandalism, arson or even assassination. Those who refuse face threats and blackmail instead. The agency says the networks target people with debt, addiction or a criminal record, because that is where leverage is cheapest.

**SRI's account of the recruitment pipeline** Reported stages from first contact to sabotage act

| From | To | How |
| --- | --- | --- |
| Coordinator in Russia *(per SRI)* | Approach via social media |  |
| Approach via social media | Paid low-risk task *(e.g. photograph a site)* | offers payment |
| Paid low-risk task *(e.g. photograph a site)* | Escalating missions | if recruit continues |
| Escalating missions | Arson, sabotage, attempted murder |  |
| Paid low-risk task *(e.g. photograph a site)* | Recruit refuses | if recruit balks |
| Recruit refuses | Threats, blackmail |  |
| Threats, blackmail | Arson, sabotage, attempted murder | forced compliance |

Based on [Romania's Intelligence Service (SRI)](https://agerpres.ro/comunicate/2026/10/26/comunicat-de-presa---serviciul-roman-de-informatii--1607028)

The operational layer SRI describes is standard for low-cost proxy networks: travel, lodging and payments registered to other people, foreign SIM cards, encrypted messaging apps. SRI’s own caveat is worth keeping: it says none of those indicators, taken alone, shows that a given person is involved in sabotage. They only add up in combination, which is a harder thing to prove in court than in a press release.

## A regional target list

SRI says its Russian coordinators had assigned the network a broad list across the region: state-owned and private arms factories, plus other sites of “military and industrial interest.” Separately, investigators this year found other attempted operations inside Romania against international military facilities and sites used to train Ukrainian forces, though SRI does not tie those to the same three suspects. The interior ministry says it has stepped up patrols near defence-industry sites, major transport routes and large logistics depots, calls the situation “under control,” and is asking the public to report anything suspicious to 112. President Nicusor Dan has repeatedly framed drone incursions, cyberattacks, disinformation and sabotage attempts as components of one Russian hybrid-war campaign against Romania; Foreign Minister Dan Neculaescu called the Brasov fire part of a continent-wide pattern aimed at defence production and wrote on X that “hybrid attacks will not hold us back from strengthening our resilience and defence.”

## Not an isolated case

Romania’s case lands in a year with several comparable ones. Estonia’s internal security service, KAPO, said on September 29, after a six-week investigation, that Russian intelligence had ordered an August 14-15 arson at Tallinn’s Milrem Robotics, which builds military ground robots used in Ukraine; three Latvian suspects were extradited and remanded, as [Defense News reported](https://www.defensenews.com/global/europe/2026/09/29/estonia-blames-russia-in-arson-attack-on-military-robotics-firm-milrem/). Bulgaria’s EMCO, a munitions maker, had two incidents at its depots within weeks: an August blast near Belitsa forced the evacuation of roughly 300 workers, and a September 11 fire near Gorni Varpishta destroyed a warehouse holding propellant and medium-calibre rounds, according to [EU Alive](https://eualive.net/romania-uncovers-russian-coordinated-sabotage-network-targeting-arms-industry/). Poland’s WB Electronics had a fire on August 31. Lithuania foiled an arson plot against Starlink ground equipment on October 18, weeks after a similar fire hit Starlink gear in Poland. Allied officials have catalogued this pattern before, insisting it is [failing to shift public opinion](https://rews.cc/a/nato-says-russian-sabotage-campaign-is-failing-to-sway-allie-a6a849) in the countries targeted.

[![SRI confirmă un act de sabotaj rusesc la platforma Carfil](https://i.ytimg.com/vi/VkyfF0Hj2Ns/hqdefault.jpg)](https://www.youtube.com/watch?v=VkyfF0Hj2Ns)

Antena3 report on SRI’s confirmation that Russian-coordinated sabotage caused the Carfil industrial-platform fire in Brasov. Video: Antena 3 CNN · YouTube

Al Jazeera’s reporting also places the Brasov fire alongside a maritime toll: roughly eight cargo ships struck off Romanian and Bulgarian coasts in a three-week span, with about 34 sailors dead or missing. One of those was the October 5 sinking in Romanian waters that Ukraine’s president said [killed two crew members](https://rews.cc/a/zelensky-says-russian-drones-sink-grain-ship-in-romanian-wat-b1066d). Land sabotage and sea strikes are different weapons, but Romanian officials describe them as the same campaign.

## Nobody agrees on how big the campaign is

How large that campaign actually is depends entirely on who is counting and over what period, a gap worth stating before comparing any two numbers. The International Centre for Counter-Terrorism and GLOBSEC put suspected Russia-linked industrial sabotage across Europe at 151 incidents between February 2022 and February 2026. The Munich Security Report, using Armed Conflict Location and Event Data Project figures, counted roughly 150 incidents of arson, sabotage, drone overflights and incendiary parcels across EU and NATO states for 2022 through 2025, as [Jamestown summarised](https://jamestown.org/russian-sabotage-campaign-against-nato-surges/). A joint investigation by 17 European public broadcasters under the EBU’s Eurovision News Spotlight network mapped 54 incidents it could publicly verify as Russia-linked between April 1 and October 15, 2026, out of a raw tip pool running into the hundreds; a prior EBU count for 2024-2025 had found 60, over a longer stretch, as [Baltic Sentinel reported](https://balticsentinel.eu/8570914/russia-s-hybrid-attacks-in-europe-are-growing-more-dangerous-54-incidents-identified-in-six-months). Germany’s own Joint Hybrid Defense Center logged 163 suspected sabotage cases internally through August 19, 2026, plus 1,034 drone overflights of critical infrastructure and 25 espionage investigations - but that figure covers Russia, China and Iran combined, and only four of Germany’s cases made it onto the public EBU map, according to internal papers reviewed for the broadcasters’ project and reported by [Euromaidan Press](https://euromaidanpress.com/2026/10/26/17-public-broadcasters-mapped-russias-hybrid-war-on-europe-germany-four-dots/).

NATO Secretary General Mark Rutte has said the campaign is designed to intimidate European states and erode support for Ukraine while staying below the threshold that would trigger Article 5. What the table shows is that NATO itself has no single register for the thing it says Russia is doing: no shared definition of an incident, no common attribution standard, no running total that any two allies would sign off on. Until one exists, Brasov’s arson will sit in four different databases, filed under four different numbers, and the real count for 2026 will stay a range rather than a figure.

## See also

- [Russian sabotage operations in Europe](https://en.wikipedia.org/wiki/Russian_sabotage_operations_in_Europe) — en.wikipedia.org · Continuously updated list of incidents and attributions across the continent
- [Russian Hybrid Warfare Activities in Europe: Considerations for Congress](https://www.congress.gov/crs-product/R49134) — congress.gov · US Congressional Research Service backgrounder on the broader campaign
- [3 Latvian suspects in Milrem arson extradited to Estonia, remanded](https://news.err.ee/1610144998/3-latvian-suspects-in-milrem-arson-extradited-to-estonia-remanded) — news.err.ee · Detail on the parallel Estonian prosecution
- [ROMARM](https://en.wikipedia.org/wiki/ROMARM) — en.wikipedia.org · Background on Romania's state-owned defence conglomerate