SRI foiled a sabotage operation conducted by the Russian Federation on Romania’s territory

17 January 2025

Since the second half of the year, intelligence services in Europe have signaled an escalation of sabotage activities on the territory of some EU states, with the involvement of Russian or foreign citizens linked to the Russian Federation. The specific mode of operation resulted in explosions targeting critical infrastructure or intended to support Ukraine, burning civilian targets, and vandalizing monuments or cars belonging to European officials. Such actions were directed against targets on the territory of the Czech Republic and Poland, between June and August.

Between July and August, Romania was targeted by several such abandoned attempts, as SRI managed to prevent a sabotage operation from taking place – identifying the attacker right before acting.

This mode of operation is part the hybrid techniques arsenal used by the Russian Federation in Romania, as well as in the Allied states.

Specifically, based on the cooperation with European partner intelligence services, through a range of internal measures, SRI managed to quickly identify Colombian citizen LUIS ALFONSO MURILLO DIOSA, who arrived in Romania at the end of July with the aim of carrying out diversionary actions.

SRI has firmly established the intention of LUIS ALFONSO MURILLO DIOSA to conduct sabotage actions in Romania based on a pre-established training, with precise indication of targets (in the photos previously received on the phone).

The data gathered by SRI and promptly sent to Ministry of Internal Affairs enabled his detention on July 30th, 2024, while he was thoroughly documenting the area of a recyclable materials warehouse in Bragadiru, located in the proximity of several facilities that can be classified as critical infrastructure (oil extraction wells, gas pipelines or telecommunications towers).

The Colombian citizen was subsequently detained by DIICOT and sent to trial under the charge of offense against national security (Article 403 of the Criminal Code, Acts of diversion).

The data gathered by SRI through intelligence research confirms the Colombian citizen’s affiliation to an extensive network of saboteurs targeting European countries, controlled through intermediaries by the Russian secret services. SRI’s outcomes and the assessments of the European partner services certify that the operations were conducted in a synchronized and coordinated manner from the territory of the Russian Federation.

The mode of operation specific to Russian services is emphasized by the involvement of a proxy – acting as organizer and recruiter on online social platforms – who secures and pays in advance for travel and accommodation arrangements and indicates (on encrypted applications) the type of mission, destination and targets.

The saboteur was trained to periodically report and personally collect data for the entire set of activities to be carried out, certifying them by sending images with specific milestones confirming that the person was acting as instructed.

At the same time, photo-video documentation was necessary for the use of data in fake news campaigns conducted on social media platforms, that depict, in a propagandistic manner, large-scale diversionary operations carried out by an alleged pro-Russian Ukrainian resistance group.

Campaigns meant to generate panic and undermine trust in authorities among the civilian population are predetermined and launched in an organized manner. Since the saboteur was detained and could no longer communicate with the coordinators, they were misled by the fact that a fire caused by a short circuit occurred during the same period, on 01.08.2024, but in Bragadiru village in Teleorman county.

Thus, the Russian Telegram channels falsely presented, using images from different fires, the operation targeting the location in Bragadiru, Ilfov, identified as a facility involved in supporting the Ukrainian war effort, the action being attributed to a Ukrainian resistance group that destroyed by arson a "logistic center where fuel destined for Ukraine was stored”.

The information was denied by the Romanian media at the time, following official statements issued by the Romanian authorities.

Partnership cooperation and operational flexibility enabled SRI to anticipate the situation, alongside implementing preventive interinstitutional measures: setting up risk indicators when crossing Romania's border, accelerating data exchange, joint teams and synchronization of offensive measures in real-time.