The incident involving the detention of a truck carrying weapons at the Moldovan-Romanian border between Leușeni and Albița on the night of November 19/20, 2025, is a typical example of how a real security event can be taken over, reframed, and exploited in a complex information operation involving domestic political actors, the local press, and the media ecosystem controlled or influenced by the Russian Federation. This analysis correlates the OSINT investigation of the images, the media dynamics in Romania, Moldova, and Russia, and the profile of the narratives identified, in order to reconstruct the structure of a potential operation under false flag and the amplification mechanism that followed.
From a factual point of view, the incident presents a series of atypical elements from the outset. According to the report published by analysts Andrei Curăraru and Artur Leșcu (WatchDog.md), the truck—seized at 1:30 a.m. on November 20—belongs to S.P.-Solar Sistem, a civilian company with no military activities, and one of the founders claims that he agreed to the export at the request of a "friend," a situation frequently encountered in smuggling networks, where seemingly legitimate companies are used as fronts for illicit shipments. According to public information, the company has three employees and is managed by Victor Procudin. The founders are Veaceslav Pîrvu (90%) and Ninel Basailov (10%).
According to information provided by the Prosecutor General's Office of the Republic of Moldova and confirmed by the Romanian authorities, the weapons discovered in the truck did not come from military or strategic depots (e.g., Cobasna or units of the National Army), but were repeatedly taken from an unidentified depot in Ukraine, two units per trip, by a carrier who made regular trips from Ukraine to the Republic of Moldova.
OSINT analysis of the images published by Ziarul de Gardă is an essential element in the subsequent deconstruction of the narratives propagated. Even a basic visual examination, without specialized tools, allows for the identification of the type, origin, and technical category of each weapon. In short, everything we see in the photos comes from the Soviet and Russian military standard, and nothing in the cargo shown is related to Western weaponry or systems delivered to Ukraine by NATO partners.
The first image shows a portable 9K333 Verba, internationally known as MANPADS or SA-29 Gizmo, is a new generation weapon designed and manufactured in Russia. It is a portable weapon used to shoot down aircraft or drones, and its shape is unmistakable: a long, olive-green tube with a massive optical assembly at the front. The proportions, color, and specific electronic block in the center correspond to the 9K333 model. Such systems were designed and manufactured during the Soviet era for decades, and their derivatives have been used on the front lines in Ukraine by both sides, continuing to be widely used in conflicts in the Middle East and Africa. It is important to note that the images do not show any structural elements that could be associated with the American Stinger system, which looks different, has markings in English, and uses a different type of electronic unit.
The second image shows several green cylindrical tubes of different sizes lying on a tarpaulin. These are RPG-26 Aglen and RPG-27 Tavolga grenade launchers – all Russian or Soviet models, not Western ones. These tubes have specific Russian inscriptions, written either in Cyrillic or with military codes such as "9M..." or "9P...", used exclusively in Soviet military cataloguing. For example, 9M designates a missile. This type of marking does not appear on any Western-produced anti-tank system, which uses NATO standards in English. Fragments of composite materials – triangular panels and a cylindrical section – can also be seen on the same tarpaulin, which appear to be drone components, most likely Shahed 136/Geran-2 for reconnaissance or improvised for attack.
In the third image, the cargo is even clearer. Dozens of single-use rocket launchers, such as RPG-26, RPG-27, or RPG-22, are arranged, all easily recognizable by their beige or green tubes. The beige tubes represent Russian-made portable anti-tank guided missiles (ATGM) "Metis" or "Kornet/Fagot" intended for export, as we can distinguish the inscriptions: "33-2AT-MISSLE"/"SERIAL NO:125".
The markings on them are in Russian and include numbers from the Soviet military factory standard:
ОКФОЛ – 3,5
ОК СНАР
9М133ФМ-3
04-20-8
С75
Where "ОКФОЛ" is the Russian abbreviation for "ОКислы ФОЛ" – a type of Soviet composite explosive used in anti-tank missiles, warheads, and cumulative charges, and 3.5 refers to the mass of the explosive in kilograms. "ОК СНАР" is a combined technical abbreviation of ОК – "Осколочно-Кумулятивный" (combined effect projectile: fragmentation + cumulative) and "СНАР" from "снаряд" (projectile). "9M133" means that the system is part of the Kornet family, "ФМ" indicates a modernized version with a thermobaric/multi-role warhead, and "–3" designates variant 3 (one of the most powerful Russian anti-tank missiles, capable of penetrating modern reactive armor). The tubes also feature the same type of front and rear caps used in Soviet weaponry from the 1980s–1990s, and none of them have Western inscriptions, NATO codes, or English markings. For example, 9M133FM-3 It is manufactured by KBP Tula (Russia) and is used in Iraq, Syria, Libya, and by the Russian army in the occupied eastern regions of Ukraine. However, new data changes the interpretation of the operational route of these weapons. Although the technical origin remains indisputably Russian (Soviet/Russian systems used in theaters of conflict), prosecutors show that the place of origin was an unidentified warehouse in Ukraine, not a military warehouse controlled by the Russian Federation. This suggests that the weapons may have come from a military trophy, precum și existența unei piețe negre active și a unei rețele criminale transfrontaliere care operează independent de lanțurile logistice tradiționale militare. Distincția între weapons manufacturing and fluxul lor actual distribution is therefore essential for the correct interpretation of the incident.
The photo published by Moldovan journalists also shows fuselage and flap elements with the warning "НЕ БРАТЬСЯ" ("DO NOT TOUCH"), a standard expression used on Russian explosive equipment and on the wings of Russian Shahed 136/Geran-2 drones.
These details are important because they categorically dismantle claims made in the public sphere that Western weapons or Stinger systems used by Ukraine were found in the truck. Nothing in the images resembles a Stinger, and the manufacturing, markings, and materials are, without exception, of Russian origin.
The new information reduces the likelihood that the incident was directly linked to a military depot controlled by the Russian Federation and suggests, rather, a fragmented criminal chain, in which shipments were camouflaged and fictitiously declared as "metal items" with a fictitious destination of Israel. This structure does not rule out a possible false flag information operation, but indicates that the original event was more likely commercial-illicit in nature rather than military.
Viewed as a whole, the images show a very familiar pattern: a mixture of anti-aircraft systems, anti-tank missiles, and rocket launchers from the same military ecosystem—the Soviet one. Unmarked wooden boxes, unofficial packaging, chaotically arranged components, and the absence of any transport documents are all indications of illegal or clandestine transport, not a regular military delivery. The way these weapons are packaged suggests either that they come from unofficial military depots or that they are in transit from areas with an active black market.
(Part II of this analysis will be published shortly.)
—
By Dr. Nicolae Țîbrigan, coordinating expert Digital Forensic Team, , Cristian Soare, analist militar <Digital Forensic Team> și Dragoș Sorescu, investigator Digital Forensics Team, in collaboration with A4E Counter Disinformation Network (CDN)
