Prosecutors Attribute Fire Near Romanian Arms Depot to Russian Sabotage Network

Romanian anti-terror prosecutors and domestic intelligence officials formally attributed a recent arson attack near the Carfil military industrial platform in Brasov to a sabotage network directed by Moscow. The joint declaration marks the first time Bucharest has directly accused Russia of executing a physical attack on its soil.[6][9]

The Directorate for Investigating Organized Crime and Terrorism (DIICOT), working alongside the Romanian Intelligence Service (SRI), announced the findings late Monday. Investigators concluded that the blaze was not an industrial accident but a deliberate operation orchestrated by foreign state actors.[6][8]

"The fire at the Carfil Brasov perimeter was caused by a sabotage network coordinated from Russia," the official DIICOT statement read, confirming weeks of speculation regarding the incident. Authorities have detained several individuals suspected of carrying out the operation under the direction of Russian handlers.[6][9]

Carfil, a subsidiary of Romania's state-owned defense company ROMARM, manufactures artillery shells and rocket-propelled grenades. The facility has been instrumental in supplying ammunition to the Ukrainian armed forces since the full-scale invasion began in 2022.[1][7]

Tracing the network

The arson targeted a perimeter area adjacent to the main production lines, attempting to disrupt the supply chain without triggering the facility's primary explosive safeguards. Emergency responders contained the fire before it could reach the high-explosive storage bunkers located 400 meters away.[3][5]

SRI counter-intelligence officers tracked the perpetrators' communications, uncovering encrypted channels linking the local operatives to handlers in the Russian Federation. The network reportedly relied on recruited foreign nationals and local criminal elements paid in cryptocurrency to execute the attack.[2][4]

Financial records obtained by DIICOT show transfers totaling nearly €150,000 moving through decentralized exchanges in the days leading up to the Brasov fire. Investigators believe these funds covered operational expenses, surveillance equipment, and the final payout for the arsonists.[4][8]

The Brasov incident represents a sharp escalation in what European intelligence agencies describe as a pan-continental sabotage campaign by Russian military intelligence (GRU). Until now, operations in Romania had largely been confined to cyberattacks and disinformation efforts.[1][2]

A pan-continental campaign

Across Europe, similar networks have targeted logistics hubs, defense contractors, and railway infrastructure critical to the Ukrainian war effort. In early 2026, British and German authorities arrested multiple individuals plotting arson and explosive attacks on military supply lines.[1][7]

By utilizing proxy actors rather than deployed intelligence officers, Moscow attempts to maintain a threshold of plausible deniability. This strategy complicates NATO's ability to invoke collective defense protocols, as the attacks often resemble localized criminal activity rather than state-sponsored aggression.[2][3]

Romanian officials have heightened security protocols around all ROMARM facilities and critical infrastructure nodes following the DIICOT announcement. The Ministry of Internal Affairs deployed an additional 1,200 gendarmerie personnel to guard defense manufacturing sites across the country.[4][6]

"We are facing a hybrid threat that utilizes asymmetric tactics to intimidate our defense sector," a Romanian defense ministry spokesperson stated during a press briefing on Tuesday morning. "Our production capabilities remain fully operational, and our commitment to our regional partners is unwavering."[1][8]

Strategic implications for NATO

The formal attribution places pressure on the NATO alliance to formulate a unified response to the shadow war occurring within its borders. Member states have debated how to deter proxy sabotage without triggering a direct military confrontation with the Russian Federation.[2][7]

Romania shares a 650-kilometer border with Ukraine and serves as a vital transit route for Western military assistance. The port of Constanta and the airbases in the country's east are central to the logistical pipeline sustaining the Ukrainian military in 2026.[3][7]

Russian state media dismissed the Romanian allegations as fabricated provocations designed to justify increased NATO troop deployments in Eastern Europe. The Russian embassy in Bucharest issued a statement denying any involvement in the Brasov incident, calling the DIICOT investigation politically motivated fiction.[8]

Despite the denials, European intelligence sharing has accelerated in response to the Brasov fire. The SRI is currently coordinating with Polish, British, and Baltic security services to map the broader financial and logistical networks supporting these proxy saboteurs.[2][4]

Securing the supply chain

The defense industry's vulnerability to low-tech proxy attacks has forced a rapid reassessment of industrial security standards across the continent. Facilities built during the Cold War are being retrofitted with modern surveillance and drone-detection systems to counter the evolving threat.[1][5]

Carfil management confirmed that the arson caused approximately €2.5 million in structural damage to auxiliary buildings but did not halt the production of 152mm artillery shells. The plant is currently operating on a three-shift schedule to meet the demands of both the Romanian military and export contracts.[6][9]

The individuals detained in connection with the Brasov fire face charges of terrorism, treason, and destruction of state property. Under Romanian law, convictions for state-sponsored sabotage carry sentences of up to 25 years in a maximum-security prison.[4][6]

The investigation remains active as DIICOT prosecutors attempt to identify the specific Russian intelligence officers who directed the operation. The outcome of these efforts will likely dictate Bucharest's next diplomatic steps, including potential expulsions of remaining Russian diplomatic staff.[1][8]