Two Belarusian nationals detained in Germany are being investigated over suspected plans to set fires near a railway line and an electricity transmission route in the south of the country. German investigators are also examining whether the men may be linked to a fire at a weapons plant in Romania, putting the focus on how alleged sabotage networks operate across borders.
The arrests, reported on 28 October 2026, have not established that the suspects carried out an attack, worked for Russian intelligence or acted with the approval of Belarusian authorities. Both men have been in custody since early October, while Romanian prosecutors are seeking their extradition in connection with the fire at the Carfil plant in Brasov.
The case matters because the alleged targets are not isolated military sites. Railways and power lines are part of the systems that move people, goods and military equipment, and keep homes, businesses and essential services running. A relatively small act of arson could therefore create disruption far beyond the point where it began.
A local plot with a regional trail
According to reports, the suspects were preparing fires near a railway line and an electricity transmission route in southern Germany. A fire beside a railway can lead to inspections, closures and delays, even where the physical damage is limited. An incident affecting a power line can force operators to reroute electricity and devote additional teams to securing other parts of the network.
The German investigation does not stop at the alleged plans. Authorities are checking a possible connection with the blaze that hit the Carfil weapons-manufacturing plant in Brasov during the night of 14 September. Romanian prosecutors are pursuing the men’s extradition, but the nature of any link between them and the Romanian fire remains to be established.
That makes the case more than a question of what two men may have intended to do in Germany. Investigators must also reconstruct their movements, contacts, communications, payments and instructions, then determine whether the evidence connects separate incidents to the same organisers.
Der Spiegel report on the arrests and Radio Free Europe/Radio Liberty report described the suspected preparations as serving Russian interests. That is an investigative allegation, not a judicial finding. The suspects’ nationality, by itself, does not prove the involvement of Belarusian state agencies.
Why ordinary infrastructure can have strategic value
Transport and energy networks offer potential organisers a combination of accessibility and impact. They are spread across large areas, depend on numerous exposed facilities and are difficult to guard continuously. A small fire or attempted attack can force authorities to inspect nearby sites, increase patrols and divert staff and money towards protection.
The disruption can also act as a test. An operation may reveal how quickly a suspicious incident is detected, how effectively a site is isolated and how long it takes to restore normal services. Even an unsuccessful attack can provide information about security arrangements and response times.
Since Russia launched its full-scale invasion of Ukraine in February 2022, European governments have repeatedly reported sabotage incidents in which Russian intelligence services were suspected of involvement. The International Institute for Strategic Studies has estimated that the number of such suspected attacks in Europe nearly quadrupled in 2023 and 2024.
The reported targets have included transport and energy infrastructure, warehouses and companies involved in supplying military assistance to Ukraine. In 2024, incendiary devices were found in or triggered inside DHL parcels in Germany, Britain and Poland. Polish investigators concluded that Russia’s military intelligence had organised that operation, according to the reporting available on the case. That conclusion is an investigative attribution rather than a final court finding.
In August 2026, an attempted drone attack involving explosives targeted an An-124 cargo aircraft at Leipzig Airport. The aircraft was being used to transport military aid to Ukraine, and European intelligence services attributed the operation to Russian military intelligence. Authorities have also reported fires at drone-manufacturing companies and attempted attacks on ground stations linked to Starlink satellite communications.
Pressure without open confrontation
Small-scale sabotage can impose costs without looking like a conventional military attack. A fire at a defence-related business may trigger inspections and delays. An incident near a railway can interrupt logistics. A threat to an energy facility can require operators to protect a much wider network.
The political effect may extend beyond the immediate damage. Repeated incidents can make the war in Ukraine more visible in the daily lives of European residents, create anxiety about the next target and increase pressure on governments supporting Kyiv. Security spending rises, resources are diverted and public authorities must explain how apparently ordinary locations could be attacked.
That does not mean every incident attributed to Russian intelligence had the same purpose or the same organisers. The pattern described by European authorities points to several possible functions: probing security around strategic sites, disrupting supply chains, increasing the cost of protection and creating uncertainty about the risks of continued military and financial support for Ukraine.
On 27 October, Romania’s intelligence service, SRI, said it had uncovered a sabotage network coordinated by Russian services, media reported. On 20 October, The Wall Street Journal reported that Russian President Vladimir Putin had personally ordered an intensification of sabotage operations against NATO member states. That claim remains attributed to the newspaper and is not independently established by the information available here.
The Belarusian connection
The use of alleged operatives from a country other than Russia can make attribution harder. Investigators must establish not only what the suspects planned, but who may have directed them and what they understood about the wider operation. For possible organisers, intermediaries can create distance from the target and an extra layer of deniability.
Belarus’s close political and security relationship with Russia gives the arrests a wider regional context. Alexander Lukashenko’s government has become heavily dependent on Moscow, particularly since the disputed 2020 presidential election and the subsequent repression of opposition forces. Minsk has supported Russia politically during the war against Ukraine and provided it with important strategic opportunities.
Those circumstances explain why investigators may examine possible links between Belarusian nationals and Russian services closely. They do not establish that the Belarusian government approved the alleged plans in Germany, that Belarusian security agencies participated or that Lukashenko personally knew about them. Nor can a person’s citizenship be treated as evidence of state involvement.
The immediate legal questions are more specific. What were the two men planning? Who, if anyone, gave them instructions? Can their activities be linked to the Carfil fire? And does the evidence meet the requirements for prosecution or extradition?
The answers will determine whether the arrests remain a separate criminal case or become part of a wider investigation into coordinated sabotage across Europe. For governments and infrastructure operators, the practical challenge is already clear: railways, electricity networks, airports, defence companies and communications systems must be protected against operations that may be cheap to carry out, serious in their consequences and difficult to attribute with certainty.
