Romania's domestic intelligence service says it prevented a Russia-coordinated sabotage operation on its soil, Militarnyi and Radio Svoboda reported. For months, it watched a Russian citizen who was filming military sites across the country—including, it says, Ukraine's Antonov cargo planes.

A wave of arson, drone incursions, and covert surveillance blamed on Russian handlers has spread across the continent, aimed at the logistics that keep Ukraine armed.

What the suspect was told to film

The Romanian Intelligence Service (SRI) announced on Tuesday that it had prevented the plot with national and international partners. The man had been under SRI monitoring since February 2026, part of a wider investigation into sabotage attempts on Romanian soil.

An intermediary instructed him to make photos and videos of targets of strategic military interest, SRI said. The list ran from NATO-used bases and communications nodes to defense institutions, critical infrastructure, and Ukraine's Antonov cargo planes.

SRI says the pattern matches saboteur networks run by Russian entities across Europe. It points to similar cases foiled in Romania in 2024 and 2025. The service added that Russia keeps leaning on people from vulnerable groups to carry out this work.

The Leipzig link

The case recalls an incident in Germany. On 4 August, workers found a drone rigged with explosives and a detonator beside an An-124 Ruslan at Leipzig airport. The Ruslan is a giant Antonov cargo plane. Ukraine's Antonov fleet moves oversized loads few other planes can carry, a standing target for a Kremlin trying to slow Western support without firing a shot.

Germany's government blamed Russia, and the attempt sharpened tensions between Berlin and Moscow. Russia denies any role in Europe's sabotage wave and has not addressed Romania's findings.

The disclosure comes days after Russian Shahed attack drones struck the Orlivka ferry crossing in Odesa Oblast, overnight on 1 September. The crossing sits on the Ukrainian-Romanian border.

An explosives-laden drone aimed at a Ukrainian cargo aircraft at Leipzig/Halle Airport was part of a Russian state operation, Interior Minister Alexander Dobrindt said on 1 September.

Germany has moved from suspecting foreign sabotage to formally blaming Russia for the Leipzig attack. The finding has prompted diplomatic and security measures against Moscow while the criminal investigation continues.

Police investigations, the attack pattern, and intelligence findings established Russian responsibility, Dobrindt said. The drones' configuration, components, explosives, and detonation systems resembled those used in other Russian hybrid operations—covert sabotage and disruption below the threshold of open war—and in Russia's war against Ukraine, Foreign Minister Johann Wadephul said.

The first drone, carrying explosives, was found near a Ukrainian cargo aircraft on the evening of 4 August and defused. Investigators believe a DHL freighter may have collided with a second drone while aborting its landing after the airport closed; that drone was never recovered. A third drone was found on 14 August in a field at Kabelsketal, where investigators subsequently discovered roughly 50 grams of suspected military explosive.

Leipzig/Halle is an international freight hub used by Ukrainian Antonov aircraft and NATO's strategic airlift program, through which allies charter heavy transport aircraft to move oversized military cargo.

Berlin will close the Bonn consulate on 18 September, end the operating agreement for the Russian House, a Moscow-backed cultural center, tighten entry controls for Russian nationals, seek to add more targets to EU sanctions lists, and pressure Russia's shadow fleet—opaquely owned tankers used to move Russian oil outside Western restrictions. Wadephul also summoned the Russian ambassador. Russia's Berlin embassy will remain open.

Russian Foreign Ministry spokesperson Maria Zakharova told Interfax that Moscow would respond to Germany's “anti-Russian action,” without specifying how.

NATO Secretary General Mark Rutte said the alliance stood in full solidarity with Germany, and European Commission President Ursula von der Leyen described Berlin's measures as a strong response.

Dobrindt said Germany expects further Russian hybrid attacks. The Leipzig incident follows a widening campaign of suspected Russian sabotage across Europe, including a 2024 incendiary-device attack at the same airport that Western security officials suspected Russian intelligence organized.

How the Leipzig attack unfolded

Euromaidan Press reported on 12 August, citing Die Zeit, that footage showed an explosives-laden quadcopter striking the wing of a parked Ukrainian Antonov An-124 before falling without detonating. The article also noted that a US Defense Department official told CNN that Washington assessed the drone belonged to Russian intelligence.

On 25 August, EP reported, citing Tagesschau’s NDR/WDR/SZ investigation, that investigators had expanded the case to three drones and found the third with suspected military explosive nearby in Kabelsketal, 10 days after the original attempt.