Romanian prosecutors have detained a 40-year-old Russian citizen living in the country on suspicion of attempted sabotage. From February through July 2026, he allegedly gathered militarily sensitive information while operating under the direction of a handler with whom he communicated through encrypted messaging services, according to a press release issued by Romania’s intelligence service (SRI) earlier today.
Investigators say the Russian citizen monitored Romanian and multinational military bases in Bucharest, as well as in the counties of Cluj, Constanța, Călărași and Ilfov. He allegedly photographed Romanian and allied military equipment and documented movements of troops and combat vehicles, then sent the images to his handler. Prosecutors did not identify the specific sites photographed.
The SRI, Romania’s domestic intelligence service, said it believed the intermediary directing him was acting on behalf of Russian entities but did not specify which Russian intelligence service the handler may have been linked to. The SRI said it had monitored the man since February. According to the agency, the sites that drew his interest included communications centers, NATO bases used by allied forces, defense and security institutions, critical infrastructure, and Ukrainian Antonov cargo aircraft.
State broadcaster Radio România reported that on March 20, an Antonov An-124-100M Ruslan cargo aircraft landed at Mihail Kogălniceanu Airport in Constanța County. The same airport is home to Romania’s 57th Air Base, which allied forces use for NATO’s enhanced air policing mission. Romanian authorities did not say whether that aircraft was among those the Russian citizen allegedly photographed.
Ukrainian An-124 aircraft have also figured in another investigation into suspected Russian sabotage. In early August, a drone carrying explosives and a detonator was found near several cargo planes of this type at Leipzig/Halle Airport in Germany. Investigators believe the device failed to detonate due to a malfunction.
The SRI compared the detained man’s alleged activities with two earlier operations that Romanian authorities said they had prevented.
In 2024, Colombian citizen Luis Alfonso Murillo Dios, acting on instructions from an intermediary living in Russia, surveyed oil and gas infrastructure in Romania and prepared to set fire to or blow up those sites. He was later sentenced to six years in prison. In October 2025, two Ukrainians whom Romanian intelligence also linked to Russian intelligence tried to leave two packages containing remotely controlled incendiary devices at the Bucharest office of Ukrainian delivery company Nova Poshta.
