The Polish Central Bureau of Investigation has detained 25-year-old Ukrainian citizen Artem S., whom Romanian law enforcement authorities consider one of three members of a sabotage cell. According to the investigation, the group operated on orders from Russia and is involved, in particular, in the arson of a defense enterprise in Brasov, Romania. The detention took place on Polish territory, highlighting the transnational nature of the investigation and coordination between law enforcement agencies of several EU countries.

The suspect's role: reconnaissance and financing

According to information obtained by RMF FM from Romanian security sources, Artem S. was not supposed to carry out the arson directly. His likely role in the group involved reconnaissance functions: identifying the target for the attack and providing financing for the operation. This indicates a clear division of tasks within the sabotage cell, where each participant performed a highly specialized function. The investigation is also checking information regarding the group's potential plans against other targets, including Ukrainian military training centers, state and private arms manufacturing enterprises, and other industrial facilities in Romania.

The fire in Brasov: chronology and scale

At the center of the investigation is an incident that occurred on September 14, 2026, at the Carfil industrial site in Brasov, located in close proximity to the Romarm state defense conglomerate's enterprise. The fire engulfed an area of about 1,000 square meters. The Romanian Intelligence Service had previously exposed a sabotage network which intelligence data indicates was coordinated by Russia. It was this fire that became the key episode linking the Ukrainian detained in Poland to a broader network of sabotage activities within a NATO member state.

International dimension: Belarusian citizens in Germany

According to Romanian security services, Artem S. may have cooperated with two Belarusian citizens who were detained in Germany. This expands the geography of the investigation to three EU countries—Poland, Romania, and Germany—and confirms that the sabotage infrastructure, according to the investigation, was built using transnational connections. Coordination between the law enforcement agencies of these states is likely carried out through Europol channels and national intelligence agencies.

Context: escalation of sabotage activity against NATO

The detention fits into a broader context previously reported by The Wall Street Journal, citing European officials: Russian leader Vladimir Putin, according to the publication, ordered an escalation of sabotage activity against NATO countries. Romania, as the southeastern link of the alliance bordering Ukraine and the Black Sea region, is one of the priority areas for sabotage operations. The exposure of the network in Brasov and the subsequent detention of its alleged member in Poland demonstrate that intelligence and operational cooperation within NATO makes it possible to thwart such plans at the preparation stage.

The investigation continues

Currently, the case is in the active investigation phase. Investigators are checking information about possible additional targets of the group and establishing the full circle of participants. Artem S. has been detained in Poland, where he will likely face charges under national and international criminal law. The results of the investigation and potential extradition procedures will become known as the case progresses through the judicial system.