Full Breakdown
Romanian Authorities Detain Russian Citizen Over Alleged NATO Sabotage Plot
9/9/2026, 5:27:43 AM
Core Event
On September 8, Romanian security services announced the detention of a 40-year-old Russian citizen accused of filming and photographing NATO-linked military sites across Romania between February and July 2026. Prosecutors say the suspect collected visual material of equipment, personnel movements and critical infrastructure at bases in Bucharest, Cluj, Constanta, Calarasi and Ilfov counties, as well as footage of Ukrainian Antonov cargo aircraft operating on Romanian territory. The Romanian Intelligence Service (SRI) described the operation as a sabotage plot coordinated by the Russian Federation and executed through an intermediary who directed the intelligence-gathering via encrypted messaging.
Background & Context
Since Russia’s full-scale invasion of Ukraine in 2022, NATO members bordering Ukraine have reported a series of “hybrid attacks” that fall short of open warfare but include drone incursions, cyber intrusions and attempts to gather military intelligence. The SRI linked the Romanian case to a broader pattern of sabotage networks that it says have been disrupted in Romania in 2024 and 2025. A similar incident occurred on August 5 in Germany, where a drone carrying a suspected explosive charge was found near a Ukrainian An-124 Antonov aircraft at Leipzig/Halle Airport, an event later attributed by Western intelligence to Russian actors.
Key Figures & Groups
- Romanian Intelligence Service (SRI) – national intelligence agency that led the investigation and public briefing.
- Directorate for the Investigation of Organized Crime and Terrorism (DIICOT) – prosecutor’s office that seeks a 30-day preventive detention for the suspect.
- Ivan Kutsenko – name identified by Romanian media for the detained Russian citizen.
- Romanian Interior Ministry’s organized-crime directorate and Defense Ministry’s intelligence directorate – partnered with SRI and foreign services in the operation.
Official Statements & Responses
The SRI stated that the suspect was instructed by an intermediary to capture images of “strategic military interest” and that the operation was thwarted through cooperation with national and international partners. The Romanian Directorate for Investigating Organized Crime and Terrorism announced that a request for a 30-day preventive detention will be submitted to the Bucharest Court of Appeal. The European Union, in early September, condemned the rise of Russian hybrid attacks on member states, while Moscow denied any involvement.
Data & Statistics
- Surveillance period: February – July 2026.
- Number of counties where material was collected: five (Cluj, Constanta, Calarasi, Ilfov, Bucharest).
- Prior disrupted sabotage attempts in Romania: two (2024, 2025).
The case underscores ongoing concerns about Russian intelligence activities targeting NATO infrastructure in Eastern Europe.
