Romania's domestic intelligence service says it prevented a Russia-coordinated sabotage operation on its soil, Militarnyi and Radio Svoboda reported. For months, it watched a Russian citizen who was filming military sites across the country—including, it says, Ukraine's Antonov cargo planes.

A wave of arson, drone incursions, and covert surveillance blamed on Russian handlers has spread across the continent, aimed at the logistics that keep Ukraine armed.

What the suspect was told to film

The Romanian Intelligence Service (SRI) announced on Tuesday that it had prevented the plot with national and international partners. The man had been under SRI monitoring since February 2026, part of a wider investigation into sabotage attempts on Romanian soil.

An intermediary instructed him to make photos and videos of targets of strategic military interest, SRI said. The list ran from NATO-used bases and communications nodes to defense institutions, critical infrastructure, and Ukraine's Antonov cargo planes.

SRI says the pattern matches saboteur networks run by Russian entities across Europe. It points to similar cases foiled in Romania in 2024 and 2025. The service added that Russia keeps leaning on people from vulnerable groups to carry out this work.

The Leipzig link

The case recalls an incident in Germany. On 4 August, workers found a drone rigged with explosives and a detonator beside an An-124 Ruslan at Leipzig airport. The Ruslan is a giant Antonov cargo plane. Ukraine's Antonov fleet moves oversized loads few other planes can carry, a standing target for a Kremlin trying to slow Western support without firing a shot.

Germany's government blamed Russia, and the attempt sharpened tensions between Berlin and Moscow. Russia denies any role in Europe's sabotage wave and has not addressed Romania's findings.

The disclosure comes days after Russian Shahed attack drones struck the Orlivka ferry crossing in Odesa Oblast, overnight on 1 September. The crossing sits on the Ukrainian-Romanian border.

Russia keeps striking the border crossings on Ukraine's western frontier with NATO member Romania and with Moldova, far from any front line. It has hit at least five of them in Odesa Oblast since late August, killing two civilians at one, State Border Guard Service Spokesperson Andrii Demchenko said, according to Zmina.

The crossings sit on Ukraine's borders with Moldova and with NATO member Romania, far to the west, and they carry the civilian traffic and the logistics that a country at war depends on. Hitting them disrupts supply and exit routes, and it pushes the strikes up against the alliance's edge. Drones have already crossed from these attacks into Moldovan and Romanian airspace.

Drones hit crossings far from the front

Four of the struck crossings are on the Moldovan border, and one is on the Romanian border, all in Odesa Oblast. The first came overnight on 20 August, and Russian forces hit several more Moldovan-border sites over the following days, mostly with strike drones.

Among them was the Vynohradivka crossing, hit by a Shahed drone overnight on 24-25 August. On the Romanian border, the Orlivka ferry crossing over the Danube was attacked twice in the first week of September, according to the State Border Guard Service.

A strike on Starokozache kills two

The deadliest hit came overnight on 9 September at the Starokozache crossing on the Moldovan border. Russian drones struck the checkpoint and the ground around it, killing two civilians and injuring three, and setting vehicles alight, Novyny.Live reports.

Border guards had already halted crossings and moved people away from the checkpoint to avoid a strike on a crowd, Demchenko said.

The attacks edge toward NATO

Demchenko said Russia most likely wants to disrupt logistics, but he called the strikes an act of terrorism because they hit places the attackers know are full of people.

“By striking territory where they know full well that people are present, it constitutes an act of terrorism, because they are deliberately targeting those locations,” he added.

The campaign is also spilling across borders: during the Starokozache attack, a drone entered Moldova's airspace and flew toward Romania, where Spanish F/A-18 jets on NATO air-policing duty were scrambled.