Cruel Map
Romania's discovery of a Russian-run sabotage cell tied to an arms-factory arson attempt confirms a leaked warning that Putin personally ordered a sabotage campaign against NATO's defense industry, and Brașov was just one stop on the list
Romania's intelligence service, SRI, says it has unraveled a sabotage network run by Russian handlers and tied to an attempted arson attack on the Carfil weapons plant in Brașov on September 14: “three citizens of post-Soviet states, all legally resident in the EU, carried out the groundwork”.
Uncovering a sabotage network in Romania confirms warnings about Putin's orders. He personally directed sabotage against NATO's defense industry, and Brașov was just one target on the list.
Romania's intelligence agency, SRI, dismantled a sabotage network directed by Russian handlers. The group was involved in an attempted arson attack on the Carfil weapons factory in Brașov on September 14. Preparations were carried out by three citizens of post-Soviet states who were legally living in the EU.
The SRI statement noted that the network's goals reached far beyond Romania. Russian operatives created a list of targets that included private and state-owned arms factories and other defense facilities across the region.
Campaign with a named commander
That case ceased to look isolated when The Wall Street Journal reported on October 20 that Vladimir Putin personally ordered an expanded sabotage campaign against NATO countries.
The campaign began in early August with a failed drone attack on Leipzig airport, followed by arson attacks on drone manufacturers in Estonia and Poland, a thwarted plot in Slovakia, and attempted sabotage of Starlink ground stations in Poland, Lithuania, and Bulgaria.
Reporting on the campaign points to a specific unit running it, the Department of Special Tasks inside Russian military intelligence's General Staff directorate, formed after the February 2022 invasion and commanded by Colonel General Andrei Averyanov.
According to the outlet, the campaign began with a failed drone attack on Leipzig airport in early August. A series of similar incidents followed across the continent. That same month, arson attacks targeted drone manufacturers in Estonia and Poland. Slovak security services reported stopping a similar plot in time. Additionally, Poland, Lithuania, and Bulgaria reported attempted sabotage against Starlink satellite ground stations.
Investigative reports indicate that the Department of Special Tasks within Russia's GRU military intelligence is running the operation. Created after the 2022 invasion, the unit is led by Colonel General Andrei Averyanov.
The Carfil plant in Brașov fits the unit's target profile precisely, as its production directly affects the defense capabilities of both Ukraine and NATO.
Compensating on a different front
The sabotage wave lines up closely with the state of the battlefield rather than against it. Russia's army has spent months making little meaningful progress in Ukraine, and a Kremlin unable to post battlefield wins has turned to covert operations against EU and NATO states to manufacture a different kind of result.
This wave of sabotage is closely tied to the situation on the battlefield. The Russian army has made no significant progress in Ukraine for months. Unable to achieve victories on the front lines, the Kremlin has turned to covert operations against EU and NATO countries.
Shifting the confrontation to European territory serves several goals: it tests the response speed of governments and intelligence services, reveals security gaps across different countries, and costs very little. Recruiting a few saboteurs is far cheaper than a single artillery barrage.
Pricing in the risk
Targeting defense-industrial sites also carries a cost that outlasts any single foiled attack. Factories now have to budget for heavier security, European governments for faster-reacting counterintelligence, and insurers and investors for the possibility that the next attempt succeeds where this one failed.
Attacks on defense facilities create long-term financial costs. Factories must spend more on security, governments must invest in counterintelligence, and investors and insurers must account for the risk of future sabotage.
Across Europe's defense industry, this campaign acts like an added tax on rearmament. It raises the cost of building the industrial capacity needed to defend Europe and support Ukraine.
A campaign designed to intimidate society costs Moscow very little, while creating damages that persist long after an attack is thwarted.
A line Moscow has already crossed
Running these operations through recruited nationals of third countries doesn't change who is responsible for them once Russian state structures are organizing and directing the network behind the scenes.
Sabotage carried out on EU and NATO territory against defense infrastructure is already an attack on the national security of the states involved, whatever nationality appears on the arrest warrant.
Hiring foreign nationals does not absolve Russia of responsibility when its state organs organize and direct the network.
Sabotage against defense infrastructure on EU and NATO territory is a direct attack on the national security of those states, regardless of the perpetrators' citizenship.
How European governments react next will be critical. A muted response or quietly dismantling single cells will signal to Moscow that the cost of such campaigns remains acceptably low.
Changing this calculus will require a response that treats General Averyanov's unit as a permanent instrument of Russian state policy, rather than a series of isolated local incidents.