SRI warns that Russia-coordinated networks are recruiting people online for sabotage operations in Romania and Europe

SRI warns that Russia-coordinated networks are using intermediaries and online platforms to recruit people for sabotage operations, sometimes without them knowing the real beneficiary or the purpose of the missions. The warning was published on Monday, October 26, in the Intelligence magazine, amid several investigations into actions carried out or prepared in Romania and other European countries.

Recruitment may begin with a conversation on social media, followed by offers for seemingly simple activities: photographing a building, picking up a package, or using a bank account. Payment may also be made in cryptocurrency, while requests may escalate to photographing strategic sites, transporting hazardous materials, or causing damage. Refusal may be followed by pressure or blackmail.

On the same day, SRI announced that it had identified a Russia-coordinated network suspected of involvement in the fire that broke out on September 14, 2026, at the Carfil industrial site in Brașov. DIICOT is investigating two Belarusian citizens and one Ukrainian citizen, whom it says were also targeting other military and industrial sites.

SRI also recalls the case of incendiary packages deposited at Nova Post in October 2025, as well as an operation in September 2026 in which a Russian citizen allegedly photographed military sites. The service recommends notifying the authorities by calling 112 in the event of suspicious requests and stresses that such requests must be analyzed in context.