The indictment of two Ukrainian nationals in Bucharest over an alleged Russian-directed sabotage plot is the latest development in a broader Kremlin campaign targeting European infrastructure and Ukraine’s supply lines.
Romanian prosecutors indicted two Ukrainian nationals, aged 23 and 24, on April 6 on charges of attempted sabotage and complicity in attempted sabotage, Balkan Insight reported. The charges stem from an October 2025 operation in which the pair entered Romania from Poland and deposited two parcels containing improvised incendiary devices at the Bucharest headquarters of Nova Post, Ukraine’s largest courier company, which serves as a critical logistical link between Ukrainians living abroad and those remaining in the country.
Romania’s Directorate for Investigating Organised Crime and Terrorism (DIICOT) said the parcels were concealed inside car parts and headphones and were designed for remote detonation. Forensic analysis confirmed the devices contained thermite and barium nitrate — materials previously linked to sabotage operations attributed to Russian intelligence across Europe — as well as GPS tracking components and counter-surveillance measures that investigators described as “typical of intelligence services”, Romania Insider reported. Specialists from Romania’s Intelligence Service (SRI) identified and neutralised the devices before they could be triggered.
“There was a real risk that the site could have been destroyed by fire, potentially endangering national security, given that the office is located on the ground floor of a seven-storey residential building in a central, densely populated area of Bucharest,” DIICOT investigators said, as Balkan Insight reported.
The two suspects have been held in pre-trial detention since October 2025. Their arrest was carried out in coordination with Polish authorities, who simultaneously detained six suspects in Poland. If convicted, the Ukrainians face up to ten years in prison.
Part of a Wider Network
The SRI stated at the time of the arrests that the two individuals were “part of a wider network of saboteurs targeting multiple European countries, controlled by Russian intelligence”, with similar attacks having targeted Nova Post facilities in other countries. The agency said the plot fit “a consistent operational pattern aimed at attacking the extensive infrastructure of Nova Post” and placed it within a broader context: “Romania, along with other Eastern European states such as Poland and Moldova, continues to be the target of Russian aggression whose main objective is to reduce support for Ukraine.”
Poland’s Special Services Coordinator spokesperson Jacek Dobrzynski told reporters that investigators believed the suspects “created a route of some kind to send explosives through Poland and Romania to Ukraine,” Insurance Journal reported.
A Pattern Across Europe
The Romanian case is one episode in a sustained and escalating Russian sabotage campaign across Europe. A six-month investigation by VSquare and re:Baltica, published in September 2025, traced how Russia’s GRU orchestrated a parcel bomb network that moved explosive devices through all three Baltic states, Poland, Germany, and the United Kingdom over the course of nearly a month – bypassing NATO borders multiple times. The operation recruited both Russian and Ukrainian nationals residing in the West via Telegram, coordinated by a GRU handler operating under the alias “Jarik Deppa”.
That network had a direct predecessor. In July 2024, incendiary parcels concealed in consumer goods ignited at a DHL logistics hub in Leipzig, Germany, and at a facility in the United Kingdom. Polish prosecutors subsequently confirmed the parcels were part of a test run for a Russian plot to trigger explosions on cargo flights to the United States and Canada, PBS News reported. The head of Britain’s MI5 said at the time that the UK was facing a “staggering rise” in Russian assassination and sabotage attempts.
The scale of the campaign is documented in an ICCT-GLOBSEC dataset covering February 2022 to February 2026, which identified 151 Russian-linked sabotage incidents across Europe, with Poland as the most frequently targeted country, accounting for 21 per cent of all cases, Notes from Poland reported. The dataset recorded a spike in arson and explosives plots from one incident in 2023 to 26 in 2025. Among the most serious recent cases was a November 2025 attack in which Ukrainian nationals working on behalf of Russian intelligence blew up a section of railway in Poland used to transport goods to Ukraine, as the Atlantic Council reported.
NATO described the level of sabotage threats in 2025 as “record high”. S&P Global Market Intelligence assessed in November 2025 that the campaign’s temporary decline that year represented “a strategic recalibration rather than de-escalation”, with increased activity expected in 2026.
