Key takeaways
- Romanian authorities said on 26 October that a Russian-coordinated network was behind the Brașov fire; no court has ruled yet.
- Cases in Munich, Colleferro and Bulgaria remain at press-report, unresolved or company-claim level, so responses stay largely with national prosecutors.
- Drone strikes on Black Sea shipping are overt and separate from covert sabotage; the Oleshky truce is local and limited.
Romania's domestic intelligence service (Serviciul Român de Informații, SRI) and its prosecution directorate for organised crime and terrorism (DIICOT) said on 26 October that the 14 September fire at the Carfil industrial platform in Brașov was the work of a sabotage network coordinated from the Russian Federation. The site adjoins CARFIL SA, a subsidiary of the state-owned arms group ROMARM. DIICOT named three suspects, two Belarusian nationals and one Ukrainian national, all resident in European Union states. Two of the suspects, DIICOT said, were located and placed in pre-trial detention in Germany while preparing similar acts. The third suspect was located in Poland, and a European arrest warrant for him was issued on 26 October. German and Polish authorities must extradite the suspects before DIICOT can question them. As of 27 October, Moscow had not commented on the allegations.
These are the allegations of Romanian authorities, and no court has ruled on them. Agerpres, the Romanian news agency, reported that the fire affected the premises of several commercial companies in the immediate vicinity of CARFIL SA, a ROMARM subsidiary. Observator News reported that the hall housed five firms, among them an auto service. The damage appears to have been modest. What gives the case weight is the standard of proof attached to it, because the level of evidence behind each incident shapes what governments and NATO can do next.
Three levels of proof, one pattern of targets
Incidents at European defence sites since August do not share one evidentiary standard. Sorting them by what officials have actually said separates attribution from suspicion.
At the first level, authorities have acted on the record. Estonia's government said on 29 September that the arson at Milrem Robotics in Tallinn on the night of 14 to 15 August was sabotage commissioned by Russian special services; three Latvian citizens are in custody. Bulgaria issued European arrest warrants on 19 October for two 19-year-old Germans suspected of setting fire to Starlink antennas at a facility near Sofia on 9 October; both were detained in Duisburg on 23 October. On 18 October, Lithuania said it had thwarted an arson attempt on Starlink infrastructure. Bulgaria has not said who was behind the Sofia fire, but Lithuania is treating its Starlink case as Russia-linked sabotage, Reuters reported. Even official attribution is not a verdict: in Brașov, the Russian link currently rests on SRI's assertion.
At the second level sit media-reported suspicions. On the night of 2 to 3 September, incendiary devices were thrown near the Munich offices of the defence-technology firm Helsing and the electronics group Rohde & Schwarz, and two Bulgarian nationals were detained. The Frankfurter Allgemeine Zeitung reported, citing unnamed security sources, that investigators suspect Russian military intelligence (the GRU). Munich prosecutors declined to confirm a Russian state link, citing active proceedings. That is an intelligence lead, not an attribution.
At the third level, responsibility is unresolved. Italian authorities have attributed the 13 August explosion at KNDS Ammo Italy in Colleferro, near Rome, to no one. The Bulgarian arms maker EMCO ruled out human error in the 10 August blast at its depot and called the 11 September fire sabotage, without naming any suspect. The interior minister listed sabotage among the versions examined while also citing poor storage conditions, as Crisis.Zone reported. Neither the Bulgarian government nor state prosecutors have attributed the blasts to Moscow.
Observers are reading: how recruitment mechanics, target selection and legal thresholds fit together, and why the evidence gap is also a political one.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
A separate theatre: overt strikes at sea
The Black Sea campaign belongs to a different category. During October, at least eight commercial cargo vessels and chemical tankers were struck by drones off the coasts of Romania and Bulgaria, and about 34 sailors were reported dead or missing. The chemical tanker Wine Trader, flagged in San Marino, was set ablaze near Sulina on 15 October with seven crew missing. The tanker Yara J was hit on 14 October. The Ukrainian-owned bulk carrier Chelsea 3 was struck off Byala, and another freighter sank off Krapets with 11 missing. Romanian President Nicușor Dan and EU foreign policy chief Kaja Kallas described the attacks as spillover from Russia's armed aggression. Defence Minister Radu Miruță said the weapons were likely Russian Geran-4 drones. Romanian F-16s intercepted two drones over territorial waters on 17 October.
This is overt kinetic action against merchant shipping, not clandestine factory sabotage. Moscow has also declared logistics a target set: Russia's Defence Ministry said in September that it had struck "infrastructure facilitating military cargoes from Europe in Western Ukraine".
Diplomacy has not changed this. On 27 October Russia suspended strikes toward Kherson city under a humanitarian ceasefire around occupied Oleshky, which the White House said Melania Trump had helped secure. The Kremlin and regional observers said it is not a general cessation of hostilities.
Observers are reading: why NATO's Black Sea surge does not answer land sabotage, and the three procedural tests that could change attribution.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
The threshold problem
The Brașov case shows how far a single investigation can travel when a national prosecutor, an intelligence service and several partner states cooperate. It also stands out against the other cases covered here. Several comparable incidents remain at the level of press reports, unresolved causes or company claims, and that evidentiary spread shapes the response.
Washington's position illustrates the limits. US ambassador to NATO Matthew Whitaker said on 5 September that members "should not tolerate deliberate actions of hybrid war", but he said the response to such challenges is "primarily national", though the United States supports countries dealing with them, Reuters reported. His statement answered who Washington would name, not how many incidents would move the alliance beyond national measures. Whether prosecutions can supply a standard of proof that allies accept collectively will be tested case by case in the coming months.
Become an Observer (it's free) to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
