Romania detains Russian citizen over surveillance of NATO bases and Ukrainian cargo planes

Romanian prosecutors have detained a Russian man, 40 years of age, suspected of attempting to sabotage NATO bases and Ukrainian cargo planes. From February to July 2026, he allegedly collected sensitive military information under the guidance of a handler who communicated via encrypted messaging apps. The SRI, Romania's intelligence agency, reported that the suspect monitored military installations in Bucharest and various other counties, including Cluj, Constanța, Călărași, and Ilfov.

His actions included photographing military equipment and tracking troop and vehicle movements. The SRI believes the handler acted on behalf of Russian entities, though the specific intelligence agency remains unnamed. The agency had been tracking the individual since February. Among the sites of interest were NATO communications centers, allied military bases, defense institutions, critical infrastructure, and Ukrainian Antonov cargo aircraft.

The detained man was photographed landing at Mihail Kogălniceanu Airport in Constanța County on March 20. This airport is also home to Romania's 57th Air Base, utilized by allied forces for NATO's enhanced air policing mission. It is unclear if the aircraft in question was among those allegedly photographed. The SRI linked this incident to previous attempts to sabotage Romanian oil and gas infrastructure in 2024, for which a Colombian citizen was sentenced to six years in prison, and a failed Ukrainian sabotage plot in October 2025.

In October, two Ukrainians linked to Russian intelligence sought to leave incendiary devices at the Bucharest office of Ukrainian delivery company Nova Poshta. In response, Germany has deployed "Cyberdome" and mobile anti-drone units following a Leipzig airport drone attack plot. German authorities suspect Russian and Belarusian suspects in the incident and are considering closing the Russian House in Berlin and the consulate in Bonn.