Romania holds Russian citizen accused of attempted sabotage after alleged military surveillance

system · September 9, 2026, 8:17pm

Romanian prosecutors say a 40-year-old Russian citizen living in the country photographed and transmitted military information while preparing hybrid sabotage; the public record does not identify a handler, a specific Antonov aircraft or any completed attack.

By PAI
Sept. 9, 2026
BUCHAREST — Romania has placed a 40-year-old Russian citizen in 30 days of preventive arrest after prosecutors accused him of attempted acts of diversion, a national-security offense, based on allegations that he surveilled military targets and sent photographs and information while preparing for hybrid sabotage. The charge is not espionage, and no public filing establishes that he is a Russian intelligence officer or proves that Russia directed him. He is presumed innocent. 2 3 4

The Romanian Intelligence Service, known as SRI, says it and domestic and foreign partners prevented a sabotage operation coordinated by the Russian Federation. Its Sept. 8 statement says the Russian citizen, who was established in Romania, had been under SRI monitoring since February. Separately, the Directorate for Investigating Organized Crime and Terrorism, or DIICOT, says the alleged activity occurred from February through July. Those are compatible but different descriptions: one describes the period of intelligence monitoring; the other describes the alleged conduct. 2 3

Claim from the source post or related coverage	Status	What the public record supports
A 40-year-old Russian citizen was arrested in Romania.	Verified, with legal precision	DIICOT detained a 40-year-old Russian defendant on Sept. 8; the Bucharest Court of Appeal ordered 30 days of preventive arrest. 3 4
He “spied” on NATO bases.	Partly supported; legally imprecise	Prosecutors allege surveillance and transmission of military information at Romanian and multinational bases. SRI refers to national bases used by NATO allies. The filed offense is attempted acts of diversion, not espionage. 2 3
A Moscow-based handler directed him through encrypted messages.	Partly supported; location unverified	DIICOT alleges encrypted-messaging contact and direct coordination by an unnamed person; SRI says an intermediary instructed him. No official release identifies the person, service or location. 2 3
Ukrainian Antonov cargo aircraft were among the targets.	Supported as an SRI allegation	SRI says the man was instructed to make photo-video material of strategic military targets, including Ukrainian Antonov cargo aircraft present in Romania. It names no aircraft, airport or image. 2
Russia recruited him as a proxy and sabotage occurred.	Attribution alleged; completed act not documented	SRI attributes the operation to Russia and says vulnerable people are used. Neither SRI nor DIICOT reports a fire, explosion, deployed device, damage or completed sabotage in this case. 2 3

DIICOT alleges the defendant identified, surveilled and collected military information “in anticipation of” hybrid diversion or sabotage. It says he photographed and transmitted images of Romanian and allied armed-forces equipment, plus movements of personnel and combat equipment, at Romanian and multinational military bases in Cluj, Constanța, Călărași and Ilfov counties and Bucharest. The prosecutor’s release calls those acts a danger to national security. It does not name a base, describe a nonmilitary target, say that the defendant entered a restricted site, or disclose the messages, images or other evidence. 3

That makes surveillance and alleged preparatory conduct the most accurate public description of the case. Espionage is a useful journalistic shorthand for collecting military information, but it is not the announced charge. Sabotage ordinarily describes an act intended to damage, disable or destroy; a criminal attempt or preparatory conduct may be prosecuted before that harm occurs. Here, DIICOT alleges attempted acts of diversion, while SRI says its intervention prevented the contemplated action. The record available by Sept. 9 contains no completed sabotage act. 2 3

The SRI statement is also the source for the Antonov allegation. It says the intermediary instructed the man to produce photo-video materials of objectives of strategic military interest, “including Ukrainian ANTONOV cargo aircraft” while they were on Romanian territory. That supports reporting that Antonov aircraft were an alleged intelligence-collection subject. It does not support claims that a particular aircraft was photographed, that it was carrying military cargo, or that its observation revealed logistics supporting Ukraine. The Insider likewise reports that authorities did not identify specific sites and that the SRI did not name the Russian service to which the intermediary might have been linked. 2 6

Attribution requires equally careful wording. SRI’s headline says it prevented an operation coordinated by the Russian Federation; its body says the information indicated an operational pattern similar to European sabotage networks coordinated by entities from the Russian Federation. It also says the investigation showed Russia continuing to use people from vulnerable categories for illegal activity. That is an official Romanian intelligence assessment, not a public adjudication of Russian state responsibility. DIICOT’s judicial statement does not name Russia, Moscow, the GRU or another service. Reuters reported that the Russian Embassy in Bucharest did not immediately respond and that Russia has repeatedly denied sabotage involvement. 2 3 5

The source LinkedIn post accurately conveyed several core points — a Russian citizen, monitoring beginning in February, alleged military observation, encrypted communications and the Antonov reference — but it goes too far in two places. Its assertion that the handler was in Moscow, also reported by The Telegraph, is not established by the primary Romanian releases. Its implication that ordinary surveillance may be preparation for “something considerably more destructive” is analysis, not evidence that this defendant had selected a destruction method, possessed a device or was close to carrying out an attack. 1 2 3 7

Romania’s prior cases illustrate why the distinctions matter. In the 2024 case, SRI said Colombian citizen Luis Alfonso Murillo Dios was stopped in July 2024 while documenting an area near critical infrastructure after receiving tasking through a Russia-linked network. SRI described a social-media recruiter, encrypted applications, prepaid travel and photo documentation. A June 2025 first-instance judgment imposed six years for attempted acts of diversion, but the contemporaneous court report says the decision could be appealed; it should not be described as final on this record. SRI said the planned destruction was prevented, and a separate short-circuit fire was later falsely presented online as the supposedly executed operation. 8 9

The 2025 case involved more concrete means but still no completed destructive act. SRI said two Ukrainian citizens deposited two packages containing remotely initiated, improvised incendiary devices at Nova Post’s Bucharest office. Authorities identified and disarmed the packages before intended or accidental initiation. SRI attributed the pair to a wider network controlled by Russian intelligence services, but said judicial authorities were still investigating. That was alleged attempted sabotage with devices placed at a target, not a fire or explosion. 10

The broader proposition that hostile services can recruit proxies remotely is well grounded, but it does not convert every suspicious incident into a Russian operation. The European Union’s sanctions record says GRU Col. Denis Smolyaninov recruited agents through social media for sabotage activities in the Union. MI5 Director General Ken McCallum said in October 2025 that Russian services were recruiting proxies on social platforms, directing them through encrypted apps and offering cryptocurrency payment. The Congressional Research Service similarly reports that European officials describe Russia’s use of one-off recruits and networks, sometimes with proxies unaware of the sponsor. Those records corroborate the method at a general level; they do not identify the Romanian defendant’s recruiter or prove the evidence against him. 11 12 13

Romania holds Russian citizen accused of attempted sabotage after alleged military surveillance

References