Romania detained a Russian who according to SRI photographed NATO bases. He was also supposed to photograph Ukrainian Antonovs

Romania's counterintelligence service SRI announced on Tuesday that it had prevented a sabotage operation on Romanian territory involving a Russian citizen residing in Romania. The DIICOT Prosecutor's Office on the same day detained a forty-year-old man and is prosecuting him for attempted sabotage acts — according to its statement, from February to July he was producing photographs of military bases used by NATO allies and recordings of equipment movements. According to SRI, he was supposed to receive instructions to document Ukrainian Antonov cargo aircraft, the same type of target that figured in the thwarted attack at Leipzig airport a month earlier. In the evening, Romanian television Pro TV placed the case in a broader context — and also identified where that parallel ends.

What investigators say he was doing

SRI states that the man was under surveillance since February 2026 and that it was an extensive investigation into attempted sabotage acts. Specifically, he was supposed to produce photographs and video recordings of communication centers, national military bases used by NATO allies, seats of institutions of Romania's defense and public order system, and elements of critical infrastructure. Digi24 ↗

The Prosecutor's Office clarified what is subject to the charge. According to the DIICOT statement, the man in the period from February to July 2026 identified, tracked and gathered information of a military nature under the direct coordination of a person with whom he maintained contact through encrypted communication applications. He was supposed to take photographs of equipment of Romanian and allied armed forces and of personnel movements at military facilities in the counties of Cluj, Constanța, Călărași and Ilfov and in Bucharest. The Prosecutor's Office emphasizes that the accused enjoys the presumption of innocence. The proposal for thirty-day detention is to be reviewed by the Court of Appeals in Bucharest — for now it is thus a detention and proposal, not a court decision. HotNews ↗

In addition to SRI and DIICOT, the operation involved a police unit for organized crime and the military intelligence service of the Ministry of Defense. SRI explicitly states cooperation with foreign partner services. Pro TV ↗

Third disclosed case in three years

What is remarkable about this case is that Romanian services describe it as part of a series, not as an isolated incident. SRI talks about a "pattern of conduct similar to that used on the territory of European states by networks of saboteurs coordinated by entities from the Russian Federation," and refers to cases thwarted in Romania in 2024 and 2025. Adevărul ↗

Both older cases are documented by the service's own statements. In the summer of 2024, Romanian authorities detained Colombian citizen Luis Alfonso Murillo Dios on the basis of SRI information — he arrived in Romania at the end of July and was detained on July 30 when he was documenting in detail the area around a recycled materials warehouse in Bragadiru near critical infrastructure facilities. The service then described the mechanism in greater detail than it does today: an intermediary recruits on online platforms, prepays travel and accommodation and through encrypted applications assigns the type of mission, destination and targets, with the executor having to continuously send photographs as proof of following instructions. From this description, today's statement repeats coordination through an intermediary and encrypted communication. The current statement says nothing about recruitment, payments for travel or ongoing reporting. SRI ↗

The second case is more recent and more specific. Between October 14 and 15, 2025, according to its own statement, SRI identified two Ukrainian citizens who, under the direct coordination of representatives of Russian secret services, were supposed to set fire to a branch of the Ukrainian courier company Nova Post in Bucharest. Two packages with an incendiary charge were placed at the branch and the service managed to find and neutralize them before they were activated. According to the service, preliminary expertise showed the use of thermite and barium nitrate with the possibility of remote detonation. SRI ↗

What is common to all three is only that SRI attributes them to one network controlled from Russia. In the form of coordination they already differ: with the Colombian and in today's case the service speaks of an intermediary, with Nova Post of direct coordination by representatives of Russian services. The nationality of the detained also differs — Colombian, two Ukrainians, now a Russian citizen residing in the country. The service adds to this that Russia "continues to use people from vulnerable categories." Three cases are too few to infer a trend from them, and nothing in the published materials explains why the profile of the detained is changing.

Antonovs are the point where it resembles Leipzig

The case stands out from the local context by one detail — the type of target. SRI writes that the man was supposed to receive instructions from the intermediary to document facilities of strategic military interest "including Ukrainian Antonov cargo aircraft during their presence on Romanian territory." It was the same type of aircraft in the thwarted attack at Leipzig/Halle airport on August 4, from which Germany blamed Russia in early September. It is a similarity in the stated targets — the published SRI statement does not mention a connection to the Leipzig case and Romanian journalists made the parallel. HotNews ↗

Pro TV elaborated on the parallel on Tuesday evening with its limits. The station, citing News.ro, recalls that on August 4 a drone with explosives and detonator was found at a Ukrainian Antonov cargo aircraft at Leipzig, and investigators later identified a third drone and approximately 50 grams of substance believed to be military explosive RDX. Leipzig/Halle airport is a NATO logistics hub and operational base for several An-124 aircraft of Antonov Airlines. The editorial team also explicitly writes that available information so far does not prove that operations in Germany and Romania were directed by the same cell or the same coordinators — the similarity is in the type of target. The phase also differs: in Leipzig, according to it, surveillance already went beyond reconnaissance, in Romania the operation stopped at reconnaissance. Pro TV sees the stakes in the fact that the An-124 is one of the few types capable of quickly transporting heavy military equipment over long distances, so their elimination or restriction of access to European airports would affect Ukrainian logistics and allied movements. Pro TV ↗

Read also: Moscow retaliated for Leipzig by closing consulate in St. Petersburg. The investigation trail leads to northern Serbia

Constanța, one of four mentioned counties, is a port hub for aid to Ukraine and also contains Mihail Kogălniceanu airport, approximately 26 kilometers from the city. Romania is expanding its military section at a cost of approximately 2.5 billion euros to an area of around 2,800 hectares to accommodate around ten thousand armed forces personnel with families — it is to become one of Europe's largest allied bases. However, the statement speaks only of counties, not of specific facilities, so it does not follow from it that the accused photographed this specific base. The War Zone ↗

Romania is also under direct pressure. On August 20, Romanian forces neutralized a naval drone near the Neptun Deep gas project platform and Bucharest blamed Russia for the incident. AGERPRES ↗

Read also: Romania destroyed a drone at the Neptun Deep project platform. It is to make the country the EU's largest gas producer

Limits of this view

The entire picture rests on statements from two Romanian state bodies. Romanian media that covered the topic — Digi24, HotNews, Adevărul and Pro TV — are built largely on SRI and DIICOT statements. The accused is innocent until a court decides otherwise, and neither his name nor the name of the alleged intermediary has been released.

The question also remains open of what exactly was to constitute the sabotage. The statement speaks of information gathering and photo documentation, thus a preparatory phase. SRI claims that the measures taken led to preventing the sabotage operation, but the specific planned attack — time, place, means — is not in the published materials. The Prosecutor's Office qualified the act as attempted sabotage acts. Whether this qualification will hold is something that court proceedings, not statements, will show.

And not every sabotage in Germany has a Russian trace — that is reason for caution here too. On the same day, German police detained a 48-year-old man near a power plant near Aachen suspected of a series of attacks on power grids in North Rhine-Westphalia, Brandenburg and Saxony. According to ZDF, in letters claiming responsibility for the acts he was supposed to refer to the destruction of the environment by fossil fuel electricity production, and authorities have so far released nothing suggesting that Russia directs such left-wing extremist actors. The German BKA counted by the end of August over 165 suspicions of sabotage — for the entire year 2025 there were over 320 — plus over a thousand observations of drones over critical infrastructure or military facilities. The wave is thus real, but authorship within it is not uniform. ZDF heute ↗

What hotinfo is following