Two young Ukrainians walked into a Nova Post office in central Bucharest carrying packages. Inside those packages: thermite-based incendiary devices disguised as audio headphones and car parts, designed to torch the building from within. Romanian intelligence was watching the entire time and prevented the worst things happened.
Romania's SRI (Serviciul Român de Informații - Romanian Intelligence Service) announced on 21 October 2025 that it thwarted a Russian sabotage operation targeting Nova Post—Ukraine's largest private courier company and the critical link between millions of Ukrainians scattered across European Union member states and those remaining in their war-torn homeland.
Romanian intelligence identified two Ukrainian citizens, ages 21 and 24, as they entered Romania from Poland—both EU member states within the Schengen Area—roughly one week before their arrest. Working with DIICOT (Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism - Romania's Directorate for Investigating Organized Crime and Terrorism), Romania's military intelligence service, and Polish security services, SRI tracked the suspects' movements across EU territory.
The surveillance proved crucial. When the two men delivered packages to Nova Post's Bucharest headquarters—located on the ground floor of a residential building in Romania's capital—Romanian intelligence already knew what was inside.
Forensic analysis revealed sophisticated incendiary devices containing thermite and barium nitrate—materials that create intense, difficult-to-extinguish fires. The devices featured remote detonation capability, allowing the saboteurs to trigger the blaze from a safe distance.
"The preliminary expertise reveals a complex modus operandi: utilization of incendiary substances (thermite and barium nitrate), concealment with the possibility of remote initiation, and adoption by the two Ukrainian citizens of self-protection measures specific to intelligence services," SRI stated.
Authorities neutralized the devices before they could be activated. The suspects now face 30 days of preventive detention on charges of attempted acts of sabotage.
Why Russia targets Ukrainian courier infrastructure across Europe
Nova Post doesn't just deliver packages. During wartime, it serves as Ukraine's circulatory system—moving money, medicine, clothing, electronics, and hope between Ukrainians abroad and those defending their country.
More than 10 million Ukrainians have been displaced since Russia's full-scale invasion began on 24 February 2022. For many who found refuge across the European Union—particularly in Poland, Romania, Germany, Czech Republic, and other EU member states—Nova Post represents their only reliable connection to family members still in Ukraine.
Every package carries both material support and emotional sustenance. Ukrainian refugees working in European cities send remittances home. Volunteers coordinate humanitarian aid shipments. Families separated by war maintain connections through parcels that cross international borders.
"The force structures aim to diminish the support granted by these states to Ukraine, in this case by attempting to damage the most extensive Ukrainian courier infrastructure, which ensures the connection of millions of Ukrainians who left the country with those who remained at home," SRI spokesperson Ovidiu Marincea explained.
By targeting Nova Post, Russia aimed to accomplish what artillery barrages couldn't: sever the bonds holding Ukrainian society together across international borders.
Romanian intelligence builds track record against Russian-aligned espionage
The Nova Post sabotage operation marks the latest in a series of successful Romanian counterintelligence operations targeting Russian and Belarusian spy networks operating across the European Union.
Just weeks earlier, in September 2025, Romanian authorities arrested Alexandru Balan, a former deputy director of Moldova's Intelligence and Security Service (SIS), for passing Romanian state secrets to Belarus's KGB. The Eurojust-coordinated operation involved intelligence services from Romania, Hungary, and the Czech Republic.
Balan, 47, who held both Moldovan and Romanian citizenship, served as Moldova's deputy intelligence chief from 2016 to 2019, heading the counterintelligence division. After leaving SIS leadership, he was appointed as liaison officer to Kyiv, officially coordinating ties between Moldovan and Ukrainian intelligence services.
Romanian prosecutors revealed that between 2024 and 2025, Balan met twice with Belarusian KGB intelligence officers in Budapest, Hungary. DIICOT stated there was "reasonable suspicion that these meetings were intended for the transmission of instructions and the payment of services rendered" in exchange for classified information that endangered Romania's national security.
Moldova's former Defense Minister Anatol Salaru described Balan to Romanian media as "the main anti-Romania figure in Moldova's SIS," accusing him of recruiting Bessarabian students in Romania for intelligence purposes and orchestrating bribery schemes.
The Balan case exposed how Belarus's KGB—which maintains its Soviet-era name and close ties to Russia's security services—operates spy networks across EU member states using diplomatic cover. Czech counterintelligence (BIS) Director Michal Koudelka emphasized that the network had grown because "Belarusian diplomats were able to move freely in Europe" under diplomatic immunity.
The successful dismantling of the Belarus spy network demonstrated the effectiveness of coordinated European intelligence cooperation through Eurojust, the EU's criminal justice cooperation agency. The same multilateral approach proved crucial in stopping the Nova Post sabotage operation just weeks later.
