Romanian intelligence arrested a 40-year-old Russian resident accused of photographing national and NATO military sites and relaying information to a handler via encrypted messages. Authorities say he was monitored since February and ordered to document strategic assets, including Ukrainian Antonov cargo aircraft in Romania. Prosecutors requested a 30-day preventative detention on national security charges; officials say the joint operation with foreign partners prevented any sabotage. The case is part of a broader pattern of suspected sabotage and hybrid attacks across Europe.
Romania Arrests Russian Suspect Over Spying On NATO Bases, Foiling Alleged Sabotage Plot
The Russian suspect, who lives in Romania, had been under surveillance since February - Reuters/Octav Ganea
Romanian authorities have detained a 40-year-old Russian national they say photographed national and NATO military sites and was acting under the direction of a Russian handler. Officials say the arrest—carried out in coordination with foreign intelligence partners—prevented an attempted sabotage operation.
Investigation and Arrest
The Romanian Intelligence Service (SRI) said the suspect, a resident of Romania, had been under surveillance since February. He was reportedly communicating with a handler in Russia via encrypted messaging services and was instructed to collect detailed information on military installations and troop movements.
Local reporting indicated the man photographed both national and NATO facilities, as well as the movement of troops and equipment across Romania. The inquiry also found he was directed to document strategic assets, specifically including Ukrainian Antonov cargo aircraft while they were on Romanian soil.
Similar plots were foiled by joint-intelligence operations in Romania in 2024 and 2025 - AFP/Daniel Mihailescu
“The Russian citizen was instructed by an intermediary to make photo-video materials with targets of strategic military interest, including Ukrainian Antonov cargo aircraft during their presence on the national territory,” the SRI said. The agency added that Russia continues to recruit vulnerable individuals to carry out such illegal activities.
Legal Action And Regional Context
Prosecutors ordered the suspect's arrest on Sept. 8 and have requested a 30-day preventative detention warrant while he faces charges related to endangering national security. Officials say the joint counter-intelligence operation prevented any sabotage and noted that similar plots were disrupted in Romania in 2024 and 2025.
Romanian authorities framed the case in the context of a broader pattern of incidents across Europe this year. Officials and analysts have linked a series of suspicious fires, arson attempts and a foiled explosive drone attack at Leipzig-Halle Airport to a wider campaign of sabotage, cyberattacks and disinformation directed against countries supporting Ukraine.
Moscow has repeatedly denied involvement in sabotage operations. The Russian embassy in Bucharest did not immediately respond to a request for comment.
Why It Matters
Authorities and analysts say these incidents appear designed to disrupt military support for Ukraine, pressure states to reduce assistance, and probe NATO's resilience to covert provocations. The Romanian case highlights ongoing European concerns about cross-border influence and hybrid operations that use local recruits and encrypted communications.
Help us improve.
