Romanian intelligence service foils Russian-linked sabotage plot targeting Ukrainian company office in Bucharest

On 21 October 2025, Romania's intelligence service (SRI) announced it had foiled a sabotage operation in Bucharest that, according to the agency, was orchestrated by Russian secret services. SRI said it identified and monitored two Ukrainian citizens, reportedly aged 21 and 24, who had entered Romania from Poland roughly a week earlier. On 14 and 15 October, the pair allegedly deposited two parcels at the Bucharest office of Nova Post, described as Ukraine's largest private courier company, located on the ground floor of a residential building in the city center.

According to SRI, the parcels contained improvised incendiary devices with remote-initiation capability, concealed inside audio headsets and car parts and fitted with GPS tracking components. The agency said preliminary analysis found incendiary substances including thermite and barium nitrate. SRI teams reportedly located and defused the devices before any activation. The two suspects were placed in preventive detention in Romania for 30 days on charges of attempted acts of sabotage. SRI characterized the suspects as operating under the coordination of Russian intelligence and as part of a wider network of saboteurs targeting European countries. Separately, Polish authorities detained a third Ukrainian national in connection with the same investigation. All allegations of Russian direction are attributed to SRI and remain unproven in court.

If SRI's account holds, the plot fits a documented pattern of arson and parcel-based sabotage across Europe attributed to Russian intelligence, frequently executed through recruited proxies offered financial incentives. The targeting of a Ukrainian courier firm, alongside coordinated detentions in Poland, suggests a transnational operation aimed at intimidating Ukrainian commercial presence and disrupting support for Ukraine. The attribution to Russia rests on SRI's claims and should be treated as alleged pending judicial proceedings. The use of thermite-based incendiaries disguised in everyday parcels indicates continued operational sophistication and a willingness to risk harm in densely populated civilian buildings.