Romania's domestic intelligence service says it prevented a Russia-coordinated sabotage operation on its soil, Militarnyi and Radio Svoboda reported. For months, it watched a Russian citizen who was filming military sites across the country—including, it says, Ukraine's Antonov cargo planes.

A wave of arson, drone incursions, and covert surveillance blamed on Russian handlers has spread across the continent, aimed at the logistics that keep Ukraine armed.

What the suspect was told to film

The Romanian Intelligence Service (SRI) announced on Tuesday that it had prevented the plot with national and international partners. The man had been under SRI monitoring since February 2026, part of a wider investigation into sabotage attempts on Romanian soil.

An intermediary instructed him to make photos and videos of targets of strategic military interest, SRI said. The list ran from NATO-used bases and communications nodes to defense institutions, critical infrastructure, and Ukraine's Antonov cargo planes.

SRI says the pattern matches saboteur networks run by Russian entities across Europe. It points to similar cases foiled in Romania in 2024 and 2025. The service added that Russia keeps leaning on people from vulnerable groups to carry out this work.

The Leipzig link

The case recalls an incident in Germany. On 4 August, workers found a drone rigged with explosives and a detonator beside an An-124 Ruslan at Leipzig airport. The Ruslan is a giant Antonov cargo plane. Ukraine's Antonov fleet moves oversized loads few other planes can carry, a standing target for a Kremlin trying to slow Western support without firing a shot.

Germany's government blamed Russia, and the attempt sharpened tensions between Berlin and Moscow. Russia denies any role in Europe's sabotage wave and has not addressed Romania's findings.

The disclosure comes days after Russian Shahed attack drones struck the Orlivka ferry crossing in Odesa Oblast, overnight on 1 September. The crossing sits on the Ukrainian-Romanian border.