INVESTIGATION: Brasov, the September 14 fire and the Russian network that recruits on social media

The first message

A message.

It arrives one evening, from an unknown account, with a friendly tone and a tempting sum.

An offer of money.

An easy task.

Watch a building, take a few photos, then wait for the next step without asking questions.

That is the beginning.

Not with a weapon.

With a phone.

The Kremlin has understood that a smartphone can do more damage than an agent trained for years.

Recruits first receive “a seemingly harmless task,” Al Jazeera describes, citing Romania’s intelligence service (SRI).

Then the next one.

Then another one.

Nobody states the final goal at the start, because nobody would accept the last step at the first message.

Every step looks small, and every step brings the recruit closer to the act they would never have accepted at the start.

All the way to fire

The slope is known.

First, take photos.

Then vandalize.

Then set fires.

Romanian investigators describe a network that slides ordinary people toward more and more serious acts.

Brasov, September 14.

The slope reaches its end.

Near an arms factory.

Let us follow the thread.

The thread leads to Moscow.

That is the conclusion of the Romanian authorities themselves, not a columnist’s hypothesis.

September 14

Brasov, central Romania.

September 14.

A fire.

It breaks out near CARFIL SA, a factory tied to the national arms industry, Rebecka Pieder reports in The Kyiv Independent.

At the time, nothing links this fire to a distant war, nor to a foreign intelligence service.

An industrial fire.

A local news item.

It will take six weeks for Romanian authorities to publicly tie it to Russia.

It comes on October 26.

Six weeks.

The time of the investigation.

The surveillance images

The SRI releases images.

Surveillance images.

They show activity on the CARFIL platform shortly before the fire, News of Bahrain writes.

Shortly before.

Silhouettes.

Movements.

The SRI speaks through these images, and the message is clear: we saw, we followed, we know.

It warns the next ones.

It also wants to reassure.

The fire has witnesses.

A ROMARM subsidiary

Not just any factory.

A ROMARM subsidiary.

Romania’s national arms maker.

A NATO member country.

A country bordering Ukraine.

Targeting a Romanian arms factory means targeting an ally’s capacity to produce for its own defense and for Kyiv.

The choice is not innocent.

It is strategic.

An ally that produces munitions becomes a target as soon as it supports the invaded country.

The SRI speaks of “state and private weapons production facilities,” according to the Jerusalem Post.

State and private.

All of them targeted.

Intimidate, weaken

The goal is twofold.

Intimidate first.

Then weaken defense.

A fire does not necessarily destroy an entire factory, but it plants fear in those who work there.

Fear is expensive.

It slows things down.

It breeds doubt.

The SRI also mentions “other objectives of military and industrial interest” in the network’s sights.

Other targets.

Other possible fires.

The investigation is only beginning.

Every new arrest can open another lead, in another country of the Union.

A fire near an arms factory is never just local news.

Three people, three passports

Investigators identify three people.

Two Belarusians.

One Ukrainian.

They lived in European Union countries, Al Jazeera specifies.

Not in Russia.

Here, among us.

According to DIICOT prosecutors and the SRI intelligence service, they were coerced by Russian agents.

Coerced, then.

The word matters.

It does not excuse them, but it points to the real culprit, the one pulling the strings from afar.

It points to people who are pushed, paid and held, not agents trained in Moscow.

The uncomfortable fact

One fact is uncomfortable.

One of the suspects is Ukrainian.

That detail suits nobody in our camp, and that is exactly why it has to be faced squarely.

A Ukrainian.

Coerced, says Bucharest.

Like the other two.

The Russian network does not pick its recruits by their flag; it picks them by their weakness.

Debt, first.

Exile too.

Loneliness as well.

An exile with no job and no close family becomes the ideal recruit for a patient recruiter.

Moscow exploits everything that breaks a life, including among citizens of the country it is invading.

Two versions

And the Ukrainian suspect?

The sources diverge.

For The Kyiv Independent, he is on the run, believed to be in Poland.

On the run.

For the wire story carried by the Jerusalem Post, prosecutors are seeking the extradition of a Ukrainian “detained in Poland.”

Detained, it says.

Two versions.

The same man.

An honest investigation flags the gap instead of picking the version that suits it.

We flag it.

If the suspect is indeed detained, extradition should move faster. If not, the hunt continues.

The European warrant

One fact holds.

No version changes it.

A European arrest warrant was issued on Monday, October 26, The Kyiv Independent writes.

For the third suspect.

The other two?

Already arrested.

In Germany.

They were preparing similar attacks there, according to DIICOT.

The same model.

A network able to operate in Romania and Germany at the same time is no improvised gang.

It is organized.

So the network was not only targeting Romania, according to investigators.

Romania is seeking their extradition.

European law works.

Slowly, but it works.

Two arrests in Germany show that European police forces now know how to cooperate against these networks.

Social media as an office

Online recruitment.

On social media.

No secret meeting.

No password.

An ad, a private message, a promise of quick money for a job that seems risk-free.

The instruction manual.

Al Jazeera details it, drawing on material provided by Romanian investigators.

It is simple.

It is effective.

It costs the Kremlin almost nothing, since it pays strangers instead of risking its own agents.

Disposable strangers.

When a recruit falls, the recruiter finds another one, without Moscow losing a single agent.

Escalation by design

The tasks escalate in stages.

First the photo.

Then the vandalism.

Then the fire.

The SRI even mentions, at the end of the chain, attacks on human life.

The slope continues.

Every payment accepted makes the next refusal harder, because the recruit has already crossed a line.

The trap closes.

Very gently.

The photo becomes evidence.

Blackmail becomes possible.

A recruit held by his own photos no longer really has the option of saying no.

Wider than Brasov

Brasov is not isolated.

DIICOT says so.

So does the SRI.

The fire is “part of a larger campaign of sabotage operations attributed to the Russian Federation in Europe.”

A campaign.

In Europe.

Earlier incidents are probably linked to the same network, Romanian authorities add.

Probably, they say.

The investigation is now looking for the exact size of this network, News of Bahrain specifies.

Its size.

Its leaders.

Its other targets.

They also want to know whether other operations were planned or carried out.

Other targets tied to Kyiv

Another detail.

Other suspected attempts targeted facilities linked to the training of Ukrainian forces, News of Bahrain reports.

Training, targeted.

Ukrainian soldiers trained in Europe thus become indirect targets, on the Union’s own soil.

The war is exported.

In silence.

In small touches.

A factory here, a training center there, and the map of Russian sabotage ends up covering the continent.

Piece by piece.

Country by country.

No European country that helps Kyiv can believe itself safe from this method.

Moscow avoids the face-off. It lights fires in the corners.

A growing series

The list grows.

In Lithuania, an arson attempt targeting Starlink equipment was foiled on October 18.

Then Poland.

A similar attempt.

That was less than a month earlier.

In Tallinn, in August, a defense subcontractor suffered a fire, The Kyiv Independent recalls.

Starlink, twice.

Defense, again.

The repetition of targets leaves little room for chance, even for the most cautious reader.

The targets look alike: everything that helps Ukraine communicate, defend itself or produce.

From Bulgaria to Italy

Al Jazeera completes the map.

Bulgaria, September.

An EMCO depot explodes.

In Germany, in September, incendiary devices near the offices of a defense company in Munich.

In Italy, in August, an explosion at a KNDS munitions factory near Rome.

In Romania itself, in September, a Russian citizen detained for filming military sites.

Four countries.

Two months.

A single logic.

Each of these incidents, taken alone, looks like an accident or a local news item.

Together, they sketch a plan.

A plan aimed at factories, communications and munitions, wherever Ukraine finds help.

The freighters hit

Sabotage is not everything.

The Black Sea burns too.

At least eight freighters have been hit off Romania and Bulgaria, according to Al Jazeera.

In three weeks.

Eight ships.

About thirty-four sailors.

Dead or missing.

Their families wait for news in ports that are not at war.

Not officially.

Civilian sailors.

On October 23, a civilian freighter sank off Romania after Russian strikes.

Sank, really.

Near NATO.

The Black Sea is becoming a space where civilian sailors pay the price of a war they are not waging.

Romanian waters

Two tankers on fire.

Seven missing.

Seven families.

A Russian drone targeting Ukraine hit an apartment building in Romania, injuring two people, CP24 reports.

Not a barracks.

A Russian drone hitting a Romanian building is a reminder that NATO’s border does not stop stray machines.

A Romanian building.

On the ships, Nicusor Dan speaks of “a new example of the tragic consequences of Russia’s aggression against Ukraine.”

The war does not stay behind Ukraine’s border; it spills onto the water, onto rooftops, into factories.

NATO watches.

It counts.

Every incident on Romanian soil tests the Alliance’s patience and the strength of its promise.

A neighbor on the front line

Romania shares more than 600 kilometers of border with Ukraine, Al Jazeera recalls, from the north to the delta.

Six hundred kilometers.

A long line.

An exposed line.

President Dan describes a hybrid war.

Drones and cyberattacks.

Disinformation and sabotage.

The president names them together because they come from the same place and serve the same goal.

The same adversary.

He also speaks of an escalation on NATO’s eastern flank “this month,” according to the wire story in the Jerusalem Post.

This month.

Not last year.

An escalation this recent forces Bucharest to rethink its domestic security priorities.

What Bucharest says

Foreign Minister Dan Neculaescu answers.

Bucharest will not bow.

On X: “Hybrid attacks will not hold us back from strengthening our resilience and defense.”

A plain sentence.

A firm message.

Bucharest refuses to give in to intimidation, and that refusal also covers its support for Ukraine.

A year ago, eight people had already been arrested in Poland and Romania, Al Jazeera recalls.

Parcel bombs.

A year already.

The threat is not new.

It is growing.

The methods change, but the target stays the same: European aid to Ukraine.

The embassy’s silence

Russia stays silent.

For now.

The Russian embassy in Bucharest could not be reached outside office hours, notes the wire story carried by ThePrint.

Nobody on the line.

The denial is predictable.

Moscow has always denied.

Always, everywhere.

The Kremlin has repeated the same sentence for years, whatever the country, whatever the evidence.

The refrain is worn out.

European investigators no longer listen.

A systematic denial proves nothing, and it refutes nothing in the face of arrests and images.

The facts remain.

Arrested suspects, published images and a European warrant weigh more than a denial.

The suspects too.

Why denial no longer works

The pattern is known.

Recruit foreigners.

Pay them online.

Deny afterward.

The advantage for Moscow is obvious: no Russian agent arrested, no direct evidence, only disposable recruits.

Plausible deniability.

That is the goal.

This fog protects the people giving orders, never the people carrying them out, who end up alone before judges.

Alone, always.

But when investigators from several countries connect the same methods, the denial loses its plausibility.

Romania has connected them.

Germany made arrests.

Poland will follow.

The more the files overlap, the more the theory of isolated incidents becomes untenable.

The open questions

Several questions remain.

Who was coordinating?

How many recruits?

How many targets?

Romanian authorities speak of Russian agents, without publishing names at this stage of the investigation.

No names.

Not yet.

Names may come with the trials, if the extraditions succeed.

The size of the network remains unknown, and that may be the most worrying piece of information of all.

An unknown network.

Still active.

Nobody can say how many recruits are waiting right now for a first message, a first mission.

What we already know

The rest suffices.

A fire on September 14.

Three suspects.

Two arrested in Germany.

A European warrant.

A campaign attributed to Russia by two Romanian institutions, DIICOT and the SRI.

Images published.

Similar incidents in at least five European countries, documented by different media and authorities.

The file holds.

It rests on Romanian institutions, German arrests and verifiable facts in several countries.

It will grow.

Every country that has seen a similar fire will reread its own files in the light of Brasov.

Where the next one will strike

The next fire?

Somewhere.

A private message.

An offer.

A photo.

The network of which Brasov is only one link is still looking for candidates in Union countries.

It pays well.

At first.

The first transfers reassure the recruit, and that is precisely their function in this system.

They buy trust.

Then it holds on.

This trap closes on people who, at the start, only wanted to earn a little money.

A Europe that has to look

Europe has to look.

Not as local news.

As a front.

This front is not held with tanks, but with investigators, cameras and vigilance.

And courage.

Every arms factory, every Starlink station, every munitions depot is now a potential target for these paid recruits.

European governments must also warn their citizens against these too-good-to-be-true offers on social media.

Brasov is out. The network is still burning.

Brasov, the September 14 fire and the Russian network that recruits on social media.

How many other harmless messages are circulating right now, waiting for the next fire?

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.