Romania: A Russian Arrested, Bucharest Says It Foiled a Sabotage Coordinated by Moscow

Romanian authorities announced on Tuesday, September 8, that they had foiled a sabotage operation attributed to Russia, with the arrest of a 40-year-old Russian national residing in Romania. According to the Romanian Intelligence Service (SRI) and the specialized DIICOT prosecutor’s office, the suspect allegedly gathered military information on several sensitive sites in the country.

The SRI claims to have placed the man under surveillance since February 2026 as part of an investigation conducted with the police, Romanian military intelligence, and foreign partners. He is said to have photographed and filmed communication centers, military bases used by NATO allies, buildings related to the national defense system, as well as critical infrastructure.

Among the documented targets were also, according to the SRI, Ukrainian Antonov cargo planes temporarily present on Romanian territory. The intelligence service maintains that the suspect received his instructions from an intermediary and that the modus operandi corresponds to that of sabotage networks which Bucharest says it has already identified in several European countries.

The DIICOT specifies that the alleged acts took place between February and July 2026. The suspect is said to have monitored equipment belonging to Romanian and allied forces, as well as movements of personnel and military equipment in Bucharest and the counties of Cluj, Constanța, Călărași, and Ilfov, communicating with his contact via encrypted messaging services.

The Bucharest Court of Appeal ordered on Tuesday the pre-trial detention of the Russian national for 30 days, following his seizure by DIICOT. Moscow’s responsibility in the operation is an accusation made by Romanian authorities: Russia has generally denied Western accusations of sabotage and hybrid actions in Europe. The Russian embassy in Bucharest had not responded immediately, according to Reuters.

NATO bases and Ukrainian planes among the targets

The SRI indicates that the intelligence gathered concerned, in particular, national and multinational military installations. Romania, a NATO member and a country bordering Ukraine, hosts allied units and plays an important logistical role on the eastern flank of the Alliance.

The investigators state that the objective was to prepare acts of “diversion” or hybrid-type sabotage. They have not publicly detailed the exact nature of any planned attack, nor indicated whether explosives or weapons were seized.

Accusations of Hybrid Actions in Europe

The case arises in a context of increasing European accusations targeting hybrid actions attributed to Russia, involving notably espionage, cyberattacks, disinformation, or sabotage. In Germany, another case of this kind recently led Berlin to order the closure of the Russian House. Moscow regularly disputes these accusations.

The SRI assures that the operation was halted thanks to the cooperation between its services, DIICOT, the Ministry of the Interior, military intelligence, and international partners. The judicial investigation continues in order to establish responsibilities and any possible ramifications of the network.