The detention in Germany of two Belarusian citizens suspected of preparing arson attacks near a railway line and a power transmission line, together with an investigation into their possible involvement in a fire at Romania’s Carfil defense plant in Brașov, may indicate that Russian intelligence services are using cross-border sabotage networks to attack European critical infrastructure and defense-industrial capabilities.
The most significant aspect of this case is the possible connection between sabotage operations in two NATO countries targeting different but interdependent components of Europe’s defense-support system. Rail infrastructure enables military mobility, power grids sustain industrial facilities and logistics hubs, and defense companies play a direct role in producing weapons and ammunition.
If investigators confirm the detainees’ involvement in both incidents and establish Russian operational direction, this would provide important evidence of the use of mobile sabotage teams capable of operating across multiple European jurisdictions.
Establishing state complicity requires evidence of recruitment, financing, coordination, logistical support, or deliberate assistance by the relevant Belarusian authorities.
From Isolated Acts of Sabotage to a Systematic Campaign Against European Infrastructure
Since Russia’s full-scale invasion of Ukraine in 2022, European law enforcement and intelligence agencies have reported growing sabotage threats against transport hubs, energy facilities, logistics companies, and defense-sector enterprises.
According to the cited figures from the International Institute for Strategic Studies (IISS), the number of such attacks in Europe nearly quadrupled in 2023–2024. This suggests a shift in the scale of the threat, from isolated operations to a broader campaign in which different targets may be attacked according to a common strategic rationale.
Particularly revealing are reports of incendiary devices in international DHL parcels in 2024, suspicions surrounding attacks on defense enterprises, and reports of attempted strikes against infrastructure supporting military assistance to Ukraine.
Claims in the original material concerning an attack on an An-124 aircraft in Leipzig in August 2026, a sabotage network in Romania, and an October 20 Wall Street Journal report alleging that Putin personally ordered an intensification of sabotage operations require separate verification against primary sources.
The strategic logic of such operations may encompass three interrelated objectives.
First, physically damaging facilities on which the production, transportation, and delivery of military goods depend.
Second, increasing European governments’ spending on infrastructure protection, counterintelligence, and the restoration of damaged facilities.
Third, creating a political effect whereby parts of the public begin to associate support for Ukraine with heightened risks to domestic security.
Thus, even sabotage causing limited material damage can have a disproportionately large political and psychological impact.
Why Railways, Power Grids, and the Carfil Plant May Have Been Targeted
The choice of potential targets warrants particular attention.
Rail transport plays an important role in NATO military mobility and in maintaining logistics routes between Western, Central, and Eastern Europe. Damage to rail infrastructure can delay shipments, overload alternative routes, and require additional resources to protect the transport network.
Electricity supplies are essential to industrial enterprises, transport systems, and communications. Even a localized disruption of the power grid can affect several interconnected sectors.
Romania’s Carfil plant belongs to the defense-industrial sector. If a link between the suspects and the fire at the plant is confirmed, investigators will have grounds to examine whether the operations in Germany and Romania formed part of a broader effort to disrupt European defense production and logistics.
The overall strategic objective of such attacks may be not to halt military assistance to Ukraine altogether, but to systematically increase the cost, complexity, and risks of providing it.
A New Operational Model: Cross-Border Networks Instead of Traditional Agent Networks
Additional reports from Romanian and German law enforcement agencies help clarify the scope of the case.
According to Reuters on October 28, German prosecutors confirmed the detention of two Belarusian citizens, aged 39 and 50, suspected of preparing arson attacks in the Nuremberg area for payment on behalf of a foreign state or organization. The suspects have been in custody since October 7. German prosecutors did not publicly identify the client, while Der Spiegel linked the planned operations to Russia.
Reuters
On October 26, the Romanian Intelligence Service (SRI) officially stated that it had uncovered a network coordinated from the territory of the Russian Federation. According to the SRI, its assignments extended beyond Romania: Russian coordinators selected targets among state-owned and private arms manufacturers and other sites of military and industrial significance.
Another important development is the report of a third suspect, a Ukrainian citizen detained in Poland. Romanian prosecutors are seeking the transfer of all three individuals for investigative proceedings.
This points to several defining features of the possible operational model.
Cross-border operations. A single network may employ operatives living in different EU countries, moving between them, and receiving assignments concerning targets in several states.
Remote direction. According to the SRI, the coordinators were located in Russia. This model enables organizers to reduce the direct presence of career intelligence officers in countries where attacks are planned.
Use of paid operatives. German prosecutors’ information about payment points to a possible contract-based recruitment model. It may involve individuals without longstanding agent relationships with Russian intelligence services.
Compartmentalization of responsibility. Organizers, financial intermediaries, and direct perpetrators may operate in different jurisdictions, complicating efforts to establish the full chain of command.
Such a structure makes it possible to conduct operations at relatively low cost while creating substantial challenges for law enforcement agencies.
The Belarusian Factor: Individual Citizens or Involvement of the State Apparatus?
The Belarusian security services’ tight control over the domestic political environment does not mean they control every action of Belarusian citizens living abroad.
It is therefore necessary to distinguish among three possible models.
At the same time, Minsk’s strategic dependence on Moscow and the close security cooperation between the two countries make the investigation of a possible Belarusian state connection a justified counterintelligence priority.
The former may occur without Minsk’s involvement; the latter would indicate a substantially more serious level of interstate coordination.
Could Russia’s GRU Be Behind the Operation?
Russian military intelligence has a history of operations against military, logistics, and infrastructure targets abroad. The hypothesis of its possible involvement in the sabotage campaign against Europe’s defense sector therefore merits investigation.
Evidence supporting this hypothesis could include the nature of the targets, cross-border organization, use of intermediaries, and a potential connection to military assistance deliveries to Ukraine.
However, these characteristics are not unique to the GRU.
The FSB and other Russian structures may also participate in recruitment, financing, or support for influence and sabotage operations. Interagency cooperation is another possibility.
Strategic Objective: Undermining NATO Military Mobility Without Open Warfare
The potential advantage of sabotage for the Kremlin lies in its ability to create security problems on NATO territory while remaining below the threshold of an unmistakable interstate armed attack.
In this context, attacks on railways, energy infrastructure, and defense enterprises may serve four purposes:
Disrupting the movement of military cargo and the maintenance of defense production.
Second, forcing NATO countries to divert additional resources to domestic security rather than other defense priorities.
Testing the ability of European intelligence and law enforcement agencies to detect cross-border networks in time.
Creating political uncertainty over what NATO’s collective response should be to sabotage organized by a foreign state but carried out by civilian operatives.
At the same time, the hybrid nature of an operation does not mean that it will necessarily remain below the threshold of an armed attack. The scale and consequences of a particular attack may matter for its classification under international law.
The risk of miscalculation by Moscow is particularly serious: an operation conceived as limited sabotage could cause substantial loss of life or critical damage and provoke a much stronger response from the Allies.
The detention of two Belarusian citizens in Germany should be viewed in the context of the broader threat of cross-border sabotage against Europe’s critical and defense infrastructure.
Official statements by Romanian authorities indicate that the investigation extends beyond a single arson incident in Brașov: according to the SRI’s assessment, it concerns a network coordinated from Russian territory and focused on several categories of military and industrial targets across Europe.
The defining feature of this model is its capacity to damage NATO countries’ defense capabilities without the direct deployment of regular Russian forces. The use of foreign nationals, financial intermediaries, and remote direction complicates attribution and creates room to deny state involvement.
The Belarusian factor requires particular attention. If Belarusian state structures are proven to have facilitated the preparation or execution of these operations, this would mark a qualitatively different level of Minsk’s involvement in Russia’s hybrid campaign against Europe. Current evidence, however, does not establish such complicity as fact.
The principal strategic risk is the gradual transformation of Europe’s transport, energy, and defense-industrial infrastructure into an arena of persistent covert confrontation with Russia. Under this scenario, Moscow may seek not one major attack but the accumulation of numerous localized disruptions that increase European states’ costs, complicate support for Ukraine, and test the limits of NATO’s collective response.Joint counterintelligence investigations, information-sharing among EU and NATO states, and the ability to identify not only the direct perpetrators but also the organizers and state structures responsible for coordinating sabotage will therefore be decisive.
More on this story: From Skyeton to Rheinmetall: A New Stage in Russia’s Sabotage War in Europe
More on this story: Rails at Risk: NATO’s Most Exposed States and the Logic of Sabotage
