Ukrainian intelligence claims Russia is recruiting Ukrainian refugees for sabotage in Europe

Russian intelligence services are recruiting vulnerable Ukrainian refugees for sabotage operations in Europe, Ukraine’s Foreign Intelligence Service claims. Its statement was reported on 6 November 2026 by the Ukrainian state news agency Ukrinform. According to the service, the aim is to spread fear and weaken support for Ukraine. The claim that refugees specifically are being systematically recruited comes from the Ukrainian service; Flank had found no independent confirmation at the time of publication.

Romanian investigation involves arrests in Germany and Poland

Ukrainian intelligence cites the September fire near the Carfil SA defence plant in the Romanian city of Brașov as an example. According to the statement reported by Ukrinform, a network run by Russian intelligence services was behind the fire. The suspects include a Ukrainian citizen and two Belarusians.

The case was also covered in Romanian reports published before the Ukrainian statement. Romanian news channel Digi24 reported the position of the Romanian Intelligence Service, SRI, which announced on 26 October that it had uncovered a network coordinated by Russia and linked to the fire of 14 September 2026 at the Carfil industrial complex. This is a separate official claim about Russia’s role, not responsibility established by a court.

The suspects, who had arrived in Brașov earlier, had allowed several days to observe the complex and prepare their actions, according to Digi24’s own sources. A European Arrest Warrant issued by Romania was the basis for the Ukrainian suspect’s detention in Warsaw, Digi24 reports. According to the channel, the other two suspects, both Belarusian citizens, were arrested in Germany.

German prosecutors confirm part of this account. According to their statement, quoted by Reuters and relayed by the news agency AGERPRES, two Belarusians have been in custody since 7 October on suspicion of preparing an arson attack in the Nuremberg area in return for payment from a foreign government or organisation. Prosecutors do not name the country. In the same report, the links to Russia and the Brașov investigation are attributed to the publication Der Spiegel.

Recruitment warnings describe tasks ranging from taking photographs to arson

According to the Ukrainian service, recruitment most often takes place through social media and messaging apps, and tasks can progress from photographing sites to more dangerous activities.

SRI describes a similar mechanism in a warning quoted by Digi24. The Romanian service points to online recruitment through intermediaries, offers of paid tasks and instructions sent through messaging apps. Warning signs include requests to take photographs or carry a package, an unclear identity for the person commissioning the task and insistence on secrecy. According to SRI, seemingly harmless favours can escalate into destruction and arson.

The similarity between the two warnings does not prove that the specific suspects were recruited in this way. Neither the Romanian nor the German reports establish that they are refugees. Citizenship alone does not prove refugee status, involvement in an intelligence network or guilt.

Ukrainian figures on sabotage in Europe have not been independently confirmed

The Ukrainian service claims that around 200 acts of sabotage linked to Russia have been recorded in Europe since 2022. According to the service, 21% were in Poland, and more than 170 perpetrators have been identified. Ukrinform reports these figures, but the other reports do not confirm them. It is unclear whether the statistics include suspected, foiled and proven cases.

In the Carfil case, significant questions remain about the evidence of external coordination, the damage caused and any impact on production. A fire at an industrial complex is not sufficient grounds to conclude that arms deliveries have been disrupted. No direct Bulgarian connection to the investigation in neighbouring Romania has been established either.

Information on the investigations may be supplemented by new official statements and court documents.