The Romanian intelligence service, the SRI, announced on 26 October that it had uncovered a sabotage network coordinated from Russia and linked it to the fire that broke out in Brașov in September, right next to the complex of the state arms manufacturer CARFIL.
The Directorate for Investigating Organised Crime and Terrorism (DIICOT) is investigating two Belarusian citizens and one Ukrainian citizen for attempted sabotage.
Two suspects were arrested in Germany where, according to investigators, they were preparing similar acts, and a European arrest warrant was issued for the third, located in Poland.
According to the SRI, the organisers assigned other targets to the network, including state and private arms manufacturers and facilities of military and industrial importance.
Russian coordination of the network is currently an intelligence finding that has not yet been confirmed by the courts, and the Ukrainian suspect’s citizenship does not indicate any involvement by Kyiv.
On 14 September, a fire engulfed a unit of approximately 1,000 square metres in the Uzina 2 industrial zone, where car repair shops, a vehicle testing station and a laundry were operating. CARFIL production facilities were not reported among the damaged premises.
However, the incident shows how much the security of the arms industry depends on space managed by private companies, tenants and local authorities.
Approaches and utility infrastructure in such locations are shared, while responsibility for their protection is divided between different administrations.
Old plants, new tenants
CARFIL, the manufacturer of anti-tank systems, mortars and corresponding ammunition, has been restructuring production for years.
On 28 October 2022, the Romanian government approved a reorganisation plan worth approximately 235 million lei (around $49 million), with 130 million lei (about $27 million) expected from the sale of former civilian assets.
The plan envisages relocating non-pyrotechnic activities from the city of Brașov to Hărman, where CARFIL already has a pyrotechnic section, and from 2025 moving production to locations in Hărman and Vlădeni.
The plan thus separates the old headquarters in Brașov from the sites where production development is planned.
Carfil Industrial Parc, a company separated from CARFIL in 2003 and transferred to county jurisdiction, leases space to private companies and continues to operate at the old address.
The government plan notes that CARFIL asked tenants and park management to maintain the premises and access roads.
If a defence manufacturer has to coordinate even road maintenance with its neighbours, joint action during a police search for saboteurs or the closure of a complex due to fire will be much more difficult.
A saboteur identifying a target by the name of a former military complex may be working with outdated production maps
The geography of production is also being reshaped by new contracts. In May 2025, ROMARM approved the framework for CARFIL’s cooperation with the American company Periscope Aviation on unmanned aerial vehicles, designating a facility in Hărman for that partnership.
The Cuda and Sirin models were demonstrated in test flights in October 2025, while preparations for series production were still under way.
The security of CARFIL’s production now depends both on the civilian tenants at the old address and on the companies involved in new ventures at other locations.
Repurposing old facilities also raises questions about the reliability of the intelligence available to those selecting targets.
A saboteur identifying a target by the name of a former military complex may be working with outdated production maps, with the consequences borne by neighbouring civilian businesses.
DIICOT is treating the case as an attempted diversion, despite civilian companies suffering actual material damage, meaning that the prosecution does not consider the fire itself to be the completed offence under investigation.
The intended objective of the attack and its potential impact on national security remain under investigation.
From GRU officers to recruits hired over the internet
Explosions at ammunition depots in Vrbětice in the Czech Republic in 2014 claimed two lives.
On 29 April 2024, the Czech police concluded that they had been caused by members of the Russian military intelligence service, the GRU, and suspended the investigation because Russia refused judicial cooperation.
Reconstructing the operatives’ movements linked at least six members of Unit 29155, including its commander, to the operation.
This is the GRU’s clandestine unit for sabotage and assassinations abroad, whose members are also accused of the attempted murder of Sergei Skripal in Salisbury in 2018.
In Bulgaria, prosecutors investigated depot explosions in Lovnidol in 2011 and at the VMZ Sopot factory in 2015, and issued European arrest warrants for Russian suspects.
Professional officers using false identities and carefully planned travel operated in Vrbětice, attempting to gain access to the depots.
Recent investigations show a growing shift towards a model in which operatives are recruited through intermediaries and often have no direct contact with their handlers.
In March this year, Eurojust announced that 22 suspects had been identified in Lithuania and Poland in an investigation into incendiary parcels
In March this year, Eurojust announced that 22 suspects had been identified in Lithuania and Poland in an investigation into incendiary parcels.
They came from Russia, Latvia, Estonia, Lithuania and Ukraine, and were often in financial difficulty.
They received instructions over the internet, and tasks were divided among recruits, who were frequently paid in cryptocurrency.
Romania has its own example of such recruitment. Colombian national Luis Alfonso Murillo Diosa, acting on the orders of an individual based in Russia, was preparing in 2024 to set fire to or blow up a waste-recycling warehouse, two oil wells and a gas metering station near Bragadiru; in September 2025, he received a final sentence of six years in prison.
In August 2024, Russian Telegram channels falsely presented an unrelated fire, caused by an electrical fault, as a successful act of sabotage.
A joint investigation by four European public broadcasters, published this September, identified the individual who recruited Diosa: a Cuban-born Russian citizen from Petrozavodsk who used Telegram to offer recruits $1,500 plus bonuses for completed tasks and, according to the inquiry, organised sabotage in at least four European Union countries.
The Romanian intelligence service warns that hostile reconnaissance and photography often precede an arson attack.
Hiring through intermediaries allows organisers to run operations simultaneously across several countries and reduces the risk of the ultimate handlers being identified.
Recruits are often entrusted with only part of the operation, making it easy for them to misjudge a target and its surroundings.
A fire in a civilian workshop can then sever access to an entire industrial estate and drive up security and insurance costs for businesses with no connection to defence production.
Victoria and pre-production risks
In the same county, the German company Rheinmetall and the state-owned firm Pirochim Victoria, a subsidiary of ROMARM, signed a contract in November 2025 to build a gunpowder plant worth more than €500 million, with the German partner holding 51 per cent and the Romanian side 49 per cent.
Around 700 jobs and an annual capacity of approximately 300,000 modular powder charges are planned, with production scheduled to begin in 2028.
Rheinmetall chief executive Armin Papperger warned at the time that propellant powder was one of the primary bottlenecks in European ammunition output.
According to reports in July 2024 citing Western officials, US intelligence uncovered a Russian plot to assassinate Papperger and alerted German counterparts, who increased his security.
The intelligence indicated this was one of several Russian schemes targeting executives across the European defence industry supplying Ukraine.
The chief executive’s personal protection, however, does not extend to the scores of contractors and smaller suppliers working on site in Victoria during construction.
While European loans provide scope for major capital projects, steady manufacturing output depends on reliable contracts and the day-to-day resilience of the broader supply chain
Romania announced it would fund part of its share through SAFE, the European soft-loan facility for defence, receiving an initial disbursement of €2.5 billion in August towards an approved total of roughly €16.7 billion.
During those same weeks, CARFIL employees staged protests over unpaid wages, which the managing director, Mircea Tanțău, attributed to delayed payments from overseas clients and a shortfall in orders under the national framework contract.
While European loans provide scope for major capital projects, steady manufacturing output depends on reliable contracts and the day-to-day resilience of the broader supply chain.
The Romanian Ministry of Economy stated that the Victoria agreement includes local content clauses for domestic suppliers.
Throughout construction, civil engineering contractors, transport companies, fitters and staff from subcontractors will work on site alongside temporary holding areas, fluctuating worker rosters and access routes shared with neighbouring commercial premises.
During this phase, safeguarding the investment relies above all on personnel and infrastructure located beyond the future plant’s perimeter fence.
Account for vulnerable neighbours
The European Critical Entities Resilience Directive regulates the protection of essential services across 11 sectors, but leaves defence and national security to the competence of member states and allows specific exemptions.
In practice, the protection of mixed industrial zones must be organised by national authorities together with manufacturers, local councils and private firms.
The Romanian Ministry of Internal Affairs increased patrols around defence production sites, critical infrastructure, roads and major logistics hubs
Following the discovery of the network, the Romanian Ministry of Internal Affairs increased patrols around defence production sites, critical infrastructure, roads and major logistics hubs.
While patrols address immediate threats, future defence projects will also require permanent arrangements to protect suppliers, shared access routes and neighbouring facilities.
The government could incorporate these obligations into procurement criteria when selecting contractors, transport companies and private security firms.
If security is planned solely within the factory fence, Romania will leave an increasing number of subcontractors to shoulder individually a risk that its intelligence services have already identified as a hostile cross-border operation.
Smaller firms will face higher insurance premiums and operational disruption, while major manufacturers and the state face delivery delays on existing contracts.
Russian handlers need only trigger occasional disruption in the more accessible civilian areas of these sites to drive up the cost of European rearmament.
Bucharest must take full responsibility for securing this new capacity well before the first production line begins operating in Victoria.
