Romania Foils Russian Plot Targeting NATO Bases, Antonov Jets

Bucharest's counterintelligence service tracked a Russian-directed surveillance operation against NATO installations and Ukrainian cargo aircraft for seven months, disrupting it the same day Hungary expelled ten Russian diplomats.

Intelligence Lead

Romania's domestic intelligence service, the SRI, confirmed on 8 September that it had prevented a Russian-coordinated sabotage operation seven months in the making, run through a Russian national resident on Romanian soil who was tasked with photographing NATO military sites and Ukrainian Antonov cargo aircraft. The disruption lands on the same day Hungary's new government expelled ten Russian diplomats for activity it called incompatible with the Vienna Convention, giving Moscow's European intelligence apparatus two simultaneous setbacks in a single news cycle. Together, the two actions confirm that European counterintelligence services are now treating Russian hybrid-warfare networks as a standing, continent-wide target set rather than a series of isolated incidents.

Situation Report

The SRI stated it had monitored the Russian citizen since February 2026 as part of a diversion investigation, documenting his photo and video reconnaissance of communications centres, national military bases used by NATO allies, headquarters of defence and public-order institutions, and unspecified critical infrastructure. An intermediary had directed him toward targets of "strategic military interest," the service said, explicitly naming Ukrainian Antonov cargo aircraft present on Romanian territory during the surveillance window.

The operation was run jointly by the SRI, the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT), the Interior Ministry's organized-crime directorate, the Defence Ministry's intelligence directorate, and unnamed external partner services. Romanian authorities have not yet disclosed the suspect's identity, the current legal status of his detention, or which foreign services contributed to the case.

Hours earlier, and roughly 700 miles to the north, Hungarian Foreign Minister Anita Orban announced the expulsion of ten staff from the Russian embassy in Budapest, stating they had engaged in conduct "unacceptable for diplomats under the Vienna Convention." The move ends the diplomatic immunity Hungary had extended to Russia's mission since 2018 and signals the new Budapest government's decisive break from the Orban-era policy of shielding Russian diplomatic presence from the expulsion waves other European capitals carried out after 2022.

Moscow's Foreign Ministry spokeswoman Maria Zakharova promised a response she described as "harsh and painful," while the SRI, in its own statement, thanked national and international partners for "ensuring the security of Romanian citizens" without further elaboration.

Background & Context

The Antonov targeting is not incidental. Leipzig/Halle Airport in Germany has served as Antonov Airlines' primary European base since 2022 and routinely handles NATO military and logistics flights; on the night of 5 August, a drone carrying a suspected explosive charge was discovered beside a Ukrainian An-124 there, an incident Western intelligence services later attributed to the Russian government. The SRI's disclosure that its own suspect was steered toward filming Antonov aircraft on Romanian soil extends that same targeting logic into a second NATO member state, suggesting a coordinated reconnaissance interest in Ukraine's heavy-lift air-cargo network rather than a one-off German incident.

The SRI also noted that the surveillance pattern matched sabotage networks it disrupted in 2024 and 2025, and repeated a now-familiar assessment: Russia continues to recruit "persons from vulnerable categories" — typically low-value, disposable operatives lacking formal intelligence training — to conduct reconnaissance and diversion tasking across Europe. This mirrors disclosures from Denmark, Poland, and Estonia over the preceding weeks, in which recruitment ran through social media and gaming platforms, and operatives were often only partially aware of the strategic purpose behind their assigned tasks.

Hungary's expulsion arrives against a backdrop of political transition. Since taking office, Prime Minister Peter Magyar's centre-right government has repeatedly affirmed the EU and NATO as Hungary's core alliances, a marked departure from Viktor Orban's decade of resisting diplomatic action against Moscow. Tuesday's expulsion was Hungary's first public removal of Russian diplomatic staff since 2018.

Analysis & Assessment

The near-simultaneous timing is most plausibly coincidental in origin but strategically reinforcing in effect: Central and Eastern European governments once regarded as softer targets for Russian activity are now actively working the counterintelligence problem rather than tolerating it. For Bucharest, a third disrupted sabotage network in three years indicates either sustained Russian tasking against Romanian NATO infrastructure or a maturing detection capability — likely both.

The recruitment of "vulnerable category" operatives remains the more strategically significant thread. It suggests Russian services are optimizing for deniability and disposability over tradecraft quality, accepting a higher operational failure rate in exchange for reduced attribution risk and lower recruitment cost. If this model persists, expect continued low-sophistication but high-frequency disruption announcements across NATO's eastern flank, rather than fewer, more sophisticated operations.

Hungary's expulsion carries the heavier geopolitical signal. A durable shift in Budapest's posture toward Moscow would remove one of the EU's most consistent brakes on unified Russia policy, with implications for sanctions renewal votes and NATO consensus-building. Whether this reflects a one-off response or a genuine strategic realignment will only become clear through Hungary's conduct in coming EU Council cycles.