Ukrainian counterintelligence (SBU) detained a British national in Kyiv who switched from training Ukrainian soldiers to spying for Russia's security service (FSB).

The man arrived in January 2024 with firearms and tactical training credentials. He worked as an instructor for mobilized personnel in Mykolaiv, southern Ukraine, then moved to a border guard unit. Standard work for foreign volunteers with military expertise, according to Ukraine's security service (SBU) and Prosecutor's Office.

But by late September, he had stopped instructing. Instead, he relocated to Odesa and started advertising his services in pro-Kremlin internet groups. Russian special services made contact.

An FSB officer subsequently began assigning tasks after recruiting him, according to the investigation. The suspect passed information about foreign instructors in Ukraine's defense forces with whom he had previously communicated. He also transmitted coordinates of Armed Forces training centers in southern Ukraine where he had trained mobilized personnel.

The Russians wanted more. They sent instructions for manufacturing explosives and coordinates for a weapons cache. He retrieved a pistol with two loaded magazines from the drop site. The agency describes this as preparation for terrorist attacks.

SBU counterintelligence detected the operative, documented his activities, and arrested him at his temporary residence in Kyiv. 

He faces charges under Part 3 of Article 114-2 of Ukraine's Criminal Code: unauthorized dissemination of information about Armed Forces deployment during martial law.

The penalty runs up to 12 years imprisonment with property confiscation. He remains in custody while investigators work to establish the full scope of his activities and determine additional charges.

Two young Ukrainians walked into a Nova Post office in central Bucharest on 21 October 2025, carrying packages disguised as headphones and car parts. Inside: thermite devices designed to torch the building and sever the connection between millions of displaced Ukrainians and their families back home.

Romanian intelligence neutralized the attack and arrested the suspects—two Ukrainians allegedly recruited by Russian intelligence to sabotage their own community's lifeline. The operation was hailed as a victory against Russian sabotage networks on NATO soil.

But Romanian expert Sorin Ionița, head of ExpertForum (EFOR), warns that this success shouldn't obscure deeper problems. "The intelligence services, instead of fighting the threats, were occupied with other things," Ionița tells Euromaidan Press in an exclusive conversation. "Now they don't want to talk about that anymore."

The question remains: If Romanian intelligence can stop individual attacks, why did they overlook Wagner-connected networks, far-right extremists, and Kremlin-backed politicians building infrastructure for Russia's massive intervention in Romania's 2024 presidential election?

What the world missed about Romania's near-catastrophe

"The perception of Romania abroad was quite schematic," Ionița explains. "Not only in Ukraine, but also in the West, the nuances and games of internal politics aren't correctly perceived. Romania doesn't have a very clear profile and doesn't take strong positions on the European scene, so I wouldn't blame the world for not understanding what's happening inside Romania."

For years, Romania appeared as one of Eastern Europe's most reliably anti-Russian states—ethnically homogeneous, without a significant Russian-speaking minority, and consistently pro-NATO. Ukraine and Western partners saw it as largely immune to Kremlin subversion.

Then came the 2024 presidential election. The scale of Russian interference and the extensive networks Moscow had built inside the country shattered that assumption, forcing Romania's neighbors to reassess what they thought they knew.

While Washington saw Romania as a reliable NATO ally supporting Ukraine, Romanian government ministers were publicly exploiting anti-Ukrainian narratives for popularity points. While Brussels praised Romania's European alignment, Romanian intelligence services tolerated Wagner veterans recruiting for African operations. While the West counted Romania as solidly pro-democracy, major political parties flirted with extremists until those extremists nearly won.

Take Romanian mercenary Horatiu Potra, who worked with Wagner Group in Africa and later funded far-right presidential candidate Călin Georgescu's 2024 campaign.

Potra is now an international fugitive with proven Kremlin connections.

"It's impossible that the services—for example, the Romanian military information services—didn't know that people who were in the army, veterans, but even active military or from the gendarmerie, from the Ministry of the Interior, took unpaid leave and went to Africa with Potra to do Wagner's work there," Ionița says.

They knew. Romanian intelligence tracked these movements. The question is why they did nothing while Wagner veterans returned home and channeled money into a presidential campaign that nearly succeeded.

The overlooked corruption-extremism alliance

While Western analysts focused on Russian disinformation and TikTok algorithms, Romania's real vulnerability lay closer to home: a political establishment so consumed by corruption that it actively enabled the far-right's rise. The country's major parties didn't just ignore the extremist threat—they collaborated with it, viewing far-right parties as useful tools for managing voter anger while they continued looting state resources.

"Romania's public agenda wasn't very clear," Ionița explains. "Yes, in general, pro-Europe. We help our neighbors, Moldova, Ukraine. But the first priority of the big parties, like PSD and PNL, was different. It was about stealing more—controlling state contracts, appointments, resources. Fighting Russian influence was secondary to protecting their own corruption schemes."

Romania's major parties—the Social Democratic Party (PSD) and National Liberal Party (PNL)—maintained a pro-European facade while key figures exploited anti-Ukrainian, anti-NATO narratives for domestic popularity. When grain shipments from Ukraine created minor disruptions, ministers who officially supported Kyiv suddenly started reproducing far-right talking points.

"Every time there was a controversial issue [about Ukraine, vaccines, LGBT rights, migration, energy prices etc. - ed.] you would find a minister, usually from the Social Democrats, who was exploiting it populistically," Ionița says.

"Romania's official position was supportive: we discuss and support Ukraine. But individual ministers would reproduce speeches from the far-right AUR (Alliance for the Union of Romanians) because they wanted to be popular with their voters. And those speeches were profoundly anti-European, anti-NATO, anti-Ukrainian, and very conspiratorial."

This wasn't accidental spillover—it was deliberate strategy. AUR party served as a useful tool for siphoning votes from angry constituents. Government ministers adopted their talking points. Intelligence services looked the other way while their networks built connections to Wagner Group and Russian operatives. Nobody thought the extremists would actually threaten the establishment's power.

Then came November 2024.

When the useful extremists stopped being useful

Călin Georgescu—a far-right candidate with minimal political infrastructure and openly pro-Russian positions—won the first round of Romania's presidential election. Not through conventional campaigning, but through a sophisticated TikTok operation that bypassed traditional media entirely.

Suddenly, the extremists Romania's establishment had tolerated as manageable protest votes weren't manageable anymore. They were winning.

"The big parties thought they could control the far-right," Ionița says. "They thought AUR and candidates like Georgescu served their interests by channeling voter frustration away from the establishment parties. They were wrong."

The TikTok campaign that propelled Georgescu revealed networks Romanian intelligence had ignored for years. Accounts were coordinated. Messaging was sophisticated. Funding sources traced back to figures like Potra, who had operated openly despite his Wagner connections.

Romania's Constitutional Court ultimately annulled the election—an unprecedented move that sparked debate about democratic legitimacy versus democratic defense. But the annulment only addressed the symptom. The networks that made Georgescu's rise possible remain intact.

The Moldova comparison nobody wants to hear

Moldova faced similar Russian interference in its 2024 elections. The difference? Moldova's institutions actually fought back before the crisis reached catastrophic levels.

"In Moldova, you had very strong efforts to counter Russian influence," Ionița notes. "The intelligence services were focused, the prosecutors were active, civil society was mobilized. They weren't perfect, but they were serious about the threat."

Romania's response? Years of looking the other way, followed by panic when extremists nearly won, followed by attempts to claim credit for stopping threats they had enabled.

"I don't think they put in as many resources as they did in Moldova," Ionița says of Romanian intelligence efforts against Russian interference. The institutional priorities were elsewhere—namely, protecting the corruption networks that the major parties depended on.

/medu

Explore further

Moldova stays European—here’s how they beat $180 million in Russian bribes

Washington joins Moscow in embracing sovereignism

And now there's a new factor Americans need to reckon with.

Romania's nightmare scenario evolved further: Just as Romanian institutions finally mobilized against Russian-backed sovereignism, American political figures started amplifying similar narratives.

US Vice President JD Vance began promoting "sovereignism" as an alternative to both Russian imperialism and liberal internationalism—the exact framing that Russian operations had spent years developing in Eastern Europe.

"We expected trolling from Moscow, yes, but we didn't expect that sovereignism would become the new thing in Washington," Ionița says.

The disruption wasn't just tactical—it was strategic. Romanian intelligence services had spent months developing counter-narratives to Russian sovereignist propaganda, framing it as anti-democratic, authoritarian, and contrary to Western values.

Then American officials started using identical language to describe their own positions, but in positive terms.

How do you tell Romanians that sovereignism threatens democracy when Washington promotes it as democratic renewal? How do you counter Russian narratives about Western hypocrisy when American officials validate those narratives by embracing the same frameworks Moscow developed?

You can't do both.

"All this story about the complexity of the political game in Romania is very difficult to explain in the West," Ionița notes.

Romanian institutions kept their corruption and double-dealing quieter than Hungary's Viktor Orbán—whose public controversies regularly draw Western attention and criticism—until the incompetence and complicity publicly broke in November 2024.

"For us in Romania, it's a very difficult position," Ionița says. "We depend on America for security. We need American support against Russia. But when American political figures amplify the same narratives that Russian operations developed, what do we do?"

Why this matters beyond Romania

Romania's near-catastrophe exposes a pattern playing out across NATO's eastern flank: Institutional corruption creates vulnerabilities. Russian operations exploit them. Local establishments tolerate the exploitation until it threatens their power. Then they mobilize—often too late, always incompletely.

"The lesson for other countries is simple," Ionița says. "If you really want to fight Russian interference, you can win. But you have to start fighting before the crisis, not after. And you have to be willing to confront the corruption and institutional capture that makes your country vulnerable in the first place."

Most NATO allies aren't willing to do that work until a crisis forces the issue.

Romania matters less to Washington than Ukraine does, Ionița acknowledges. "We're not a zone of interest."

But that's precisely why Romania matters as a case study. If institutional rot can nearly capture a NATO member that nobody's watching closely, what happens when similar dynamics play out in Poland, the Baltics, or elsewhere in Central Europe?

The corruption-to-Russian-influence pipeline doesn't require geographic proximity to Moscow—just leaders more interested in protecting their own power than their country's security.

Explore further

Romania could’ve been Ukraine’s biggest ally. Hungary made sure it isn’t.

The uncomfortable questions

The Nova Post sabotage operation failed. Two suspects sit in Romanian custody. The thermite devices were neutralized before they could sever connections between displaced Ukrainians and their families at war.

Success—in the narrow tactical sense. But zoom out to the strategic picture:

• How many NATO allies are still in the "toleration" phase? Still letting Wagner connections operate while pretending not to notice? Still allowing government figures to exploit anti-Ukrainian narratives while officially supporting Kyiv?
• What happens when institutions finally decide to fight—but Washington backs the other side? When American political figures actively support sovereignist forces connected to Russian operations?
• How do you defend democracy when both Moscow and parts of Washington push in the same direction?

Romanian intelligence stopped this attack—one of several tactical victories against Russian sabotage—but only after years of overlooking the networks behind them. The institutions now seeking credit for these disruptions had long ignored warning signs about Wagner connections and far-right infiltration.

The deeper problem remains unresolved. The political establishment that enabled extremists faces no accountability. The institutional weaknesses and political compromises that made Romania vulnerable to Russian exploitation continue. And the networks that enable such operations are still active.

For American policymakers watching NATO's eastern flank, Romania offers an uncomfortable lesson: tactical successes in stopping individual attacks matter less than addressing the systemic vulnerabilities that invite them. Whether through corruption, political opportunism, or willful blindness, these weaknesses create openings for foreign intelligence services to exploit.

Washington celebrates when allies disrupt Russian sabotage. But Sorin Ionița's assessment raises a harder question: Why do some NATO members tolerate the conditions that make such operations possible until crisis forces action?