Romanian authorities suspect a sabotage operation coordinated by Russia after a fire broke out near the CARFIL SA industrial site in Brașov on 14 September 2026. SRI, DIICOT and the Romanian Police said two of three suspects were arrested in Germany, while the third was located in Poland. Investigators are treating the Brașov blaze as part of a wider effort targeting other industrial and military objectives. The probe centers on the fire at the platform connected to the Carfil facility in Brașov, operated close to CARFIL SA, a subsidiary of ROMARM. DIICOT prosecutors are running the case with support from the Directorate for Combating Organized Crime and SRI. DIICOT says the alleged network prepared further acts of “diversion” when two suspects were captured. Prosecutors also pursue possible additional actions attributed to the same group, with the exact circumstances to be established during the judicial process. European arrest mandates were issued in the case after judges at the Bucharest Court of Appeal ordered them in absentia. Two suspects were identified and placed under arrest in Germany through cooperation with foreign authorities. The third suspect was found in Poland, with Romanian authorities obtaining an additional European arrest warrant on 26 October. SRI said the sabotage attributed to Russian coordinators was not limited to Brașov. The service described other targets in Romania and elsewhere in Europe, including armament factories and military-related industrial facilities, as well as state and private sites. SRI also said recruitment would have worked across borders, using people recruited from former Soviet states who were then based in EU member countries. SRI added that recruitment was allegedly done mainly through social media. Investigators say initial tasks could involve activities like photographing buildings, monitoring industrial sites, or collecting information before escalating to acts such as arson. The service claims coordinators could rely on threats, pressure or blackmail, and used techniques meant to make the network harder to identify, including documents and payments made under other names and encrypted messaging. The latest status is that the three suspects are under arrest in Germany or located in Poland, with procedures under way to bring them to Romania as DIICOT continues the investigation.