Romania's Intelligence Service announced Monday that a September 14 fire at an industrial site near a state-owned weapons factory in Brasov was the work of a network "coordinated" by Russia. The operation targeted arms manufacturers and facilities of "military and industrial interest," according to the agency, and fits a pattern of hybrid warfare aimed at states supporting Ukraine's defence. The operational cell was small but transnational. Romania's anti-organised-crime directorate DIICOT identified three individuals — two Belarusians and one Ukrainian, all resident in EU countries. Two were detained in Germany while allegedly preparing further attacks. The third remains at large in Poland. Russia has not commented on the specific allegations and has previously denied all such accusations. The recruitment pipeline described by Romanian intelligence follows a well-documented escalation model. Operatives are found on social media, offered money for low-stakes tasks such as photographing targets, then gradually drawn into vandalism, arson, and potentially assassination. It is a classic intelligence tradecraft pattern — incremental commitment that makes it psychologically harder to exit at each stage. The Brasov fire is one node in a broader constellation of incidents across Europe. In September alone, two ammunition storage sites operated by Bulgarian arms maker EMCO suffered explosions and fires. Firebombs were thrown near a defence company's offices in Munich. An ammunition factory near Rome operated by KNDS was struck by a blast in August. Romania separately detained a Russian citizen accused of conducting reconnaissance on military sites. The maritime dimension is escalating in parallel. At least eight cargo ships have been hit off Romania and Bulgaria's coasts in recent weeks, with approximately 34 sailors dead or missing. Romanian President Nicusor Dan has framed these as direct consequences of Russia's war, calling the ship attacks "a new example of the tragic consequences of Russia's aggression against Ukraine." Romania's exposure is structural. Sharing more than 600 kilometres of border with Ukraine, the country is a NATO and EU member that sits directly on the war's geographic edge. President Dan has explicitly named the hybrid war toolkit being deployed: drone incursions into Romanian airspace, cyberattacks, disinformation campaigns, and sabotage. Foreign Minister Neculaescu responded to the Brasov revelations by stating that "hybrid attacks will not hold us back from strengthening our resilience and defense." The pattern is clear: Russia is running a distributed, deniable sabotage campaign across European defence supply chains. The targets are not random — they are the factories, storage facilities, and transport corridors that feed Ukrainian military capacity. The question is no longer whether this is happening but whether European counterintelligence and industrial security can scale their defences faster than Moscow scales its operations.
