SRI and partners prevented a Russian Federation-coordinated sabotage operation in Romania involving a Russian citizen spying on NATO and critical infrastructure.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

Aggressor

Summary

The Romanian Intelligence Service (SRI), in cooperation with DIICOT, MAI-DCCO, MApN-DGIA, and international partners, prevented a sabotage operation on Romanian territory coordinated by the Russian Federation involving a Russian citizen residing in Romania. Since February 2026, the individual was under monitoring for attempts at diversionary acts, including photo-video documentation of NATO communication centers, military bases, national defense and security institutions, and critical infrastructure. The pattern of activity matches previous attacks in 2024 and 2025 linked to Russian-coordinated sabotage networks across Europe. The Russian citizen was instructed by intermediaries to gather intelligence on strategic military targets, including Ukrainian ANTONOV cargo aircraft on Romanian soil. The investigation indicated the Russian Federation's continued exploitation of vulnerable groups to conduct such illegal activities. The coordinated actions of SRI and national and international partners successfully prevented the sabotage attempt on Romanian territory.

Classification

Confidence: High

The operation involved an adversary state (Russian Federation) directing covert sabotage efforts on Romanian territory, involving intelligence collection on military and critical infrastructure, consistent with hostile hybrid warfare activity.

Source URL

https://sri.ro/articole/comunicat-de-presa-08-09-2026-1.html

Open source

Provenance

Publisher: extension
Submitted: Sep 8, 2026, 23:53 UTC
Last updated: Nov 4, 2026, 02:47 UTC
Event time: Feb 1, 2026, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "413b0732-8b9c-4aae-8485-e1ae329d2a3b",
  "url": "https://sri.ro/articole/comunicat-de-presa-08-09-2026-1.html",
  "source": "extension",
  "status": "processed",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Romania",
  "source_reliability": "F",
  "info_credibility": "2",
  "tags": [
    "Russian Federation",
    "Sabotage",
    "Romania",
    "NATO",
    "russian intelligence operations",
    "Human intelligence",
    "Security prevention",
    "Military infrastructure"
  ],
  "nodes": [],
  "countries": [
    "Romania"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "The Romanian Intelligence Service (SRI), in cooperation with DIICOT, MAI-DCCO, MApN-DGIA, and international partners, prevented a sabotage operation on Romanian territory coordinated by the Russian Federation involving a Russian citizen residing in Romania. Since February 2026, the individual was under monitoring for attempts at diversionary acts, including photo-video documentation of NATO communication centers, military bases, national defense and security institutions, and critical infrastructure. The pattern of activity matches previous attacks in 2024 and 2025 linked to Russian-coordinated sabotage networks across Europe. The Russian citizen was instructed by intermediaries to gather intelligence on strategic military targets, including Ukrainian ANTONOV cargo aircraft on Romanian soil. The investigation indicated the Russian Federation's continued exploitation of vulnerable groups to conduct such illegal activities. The coordinated actions of SRI and national and international partners successfully prevented the sabotage attempt on Romanian territory.",
  "summary_short": "SRI and partners prevented a Russian Federation-coordinated sabotage operation in Romania involving a Russian citizen spying on NATO and critical infrastructure.",
  "summary_extended": null,
  "actor_primary": "Russian intelligence",
  "target_primary": null,
  "location_text": "Romania",
  "location_region": null,
  "location_coordinates_lat": 45.9432,
  "location_coordinates_lon": 24.9668,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The operation involved an adversary state (Russian Federation) directing covert sabotage efforts on Romanian territory, involving intelligence collection on military and critical infrastructure, consistent with hostile hybrid warfare activity.",
  "event_time_utc": "2026-02-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-09-08T23:53:00.045Z",
  "updated_at": "2026-11-04T02:47:45.957Z",
  "reliability_band": "pattern",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Feb 1, 2026, 00:00 UTC

Event time confidence

unknown

Location

Romania

Primary actor

Russian intelligence

Country

Romania

Countries

Romania

Tags

Russian Federation, Sabotage, Romania, NATO, russian intelligence operations, Human intelligence, Security prevention, Military infrastructure

Loading signal...

{ "id": "413b0732-8b9c-4aae-8485-e1ae329d2a3b", "url": "https://sri.ro/articole/comunicat-de-presa-08-09-2026-1.html", "source": "extension", "status": "processed", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "Romania", "source_reliability": "F", "info_credibility": "2", "tags": [ "Russian Federation", "Sabotage", "Romania", "NATO", "russian intelligence operations", "Human intelligence", "Security prevention", "Military infrastructure" ], "nodes": [], "countries": [ "Romania" ], "where_text": "Land", "headline": null, "description": "The Romanian Intelligence Service (SRI), in cooperation with DIICOT, MAI-DCCO, MApN-DGIA, and international partners, prevented a sabotage operation on Romanian territory coordinated by the Russian Federation involving a Russian citizen residing in Romania. Since February 2026, the individual was under monitoring for attempts at diversionary acts, including photo-video documentation of NATO communication centers, military bases, national defense and security institutions, and critical infrastructure. The pattern of activity matches previous attacks in 2024 and 2025 linked to Russian-coordinated sabotage networks across Europe. The Russian citizen was instructed by intermediaries to gather intelligence on strategic military targets, including Ukrainian ANTONOV cargo aircraft on Romanian soil. The investigation indicated the Russian Federation's continued exploitation of vulnerable groups to conduct such illegal activities. The coordinated actions of SRI and national and international partners successfully prevented the sabotage attempt on Romanian territory.", "summary_short": "SRI and partners prevented a Russian Federation-coordinated sabotage operation in Romania involving a Russian citizen spying on NATO and critical infrastructure.", "summary_extended": null, "actor_primary": "Russian intelligence", "target_primary": null, "location_text": "Romania", "location_region": null, "location_coordinates_lat": 45.9432, "location_coordinates_lon": 24.9668, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The operation involved an adversary state (Russian Federation) directing covert sabotage efforts on Romanian territory, involving intelligence collection on military and critical infrastructure, consistent with hostile hybrid warfare activity.", "event_time_utc": "2026-02-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-09-08T23:53:00.045Z", "updated_at": "2026-11-04T02:47:45.957Z", "reliability_band": "pattern", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }