On September 8, 2025, a dramatic announcement rippled across Europe: intelligence agencies from the Czech Republic, Hungary, and Romania had successfully dismantled a sophisticated espionage network orchestrated by Belarus’s notorious State Security Committee, the KGB. The operation, which unfolded over several months, exposed not only the clandestine ambitions of Minsk but also the vulnerabilities that still haunt Europe’s security architecture in the face of persistent Russian and Belarusian influence.
The investigation, spearheaded by the Czech counterintelligence agency BIS and coordinated under the watchful eye of the European Union’s judicial cooperation agency, Eurojust, revealed a network that reached into the heart of European institutions. According to BIS, the spy ring thrived in part because Belarusian diplomats, shielded by diplomatic immunity, could move freely within the Schengen area, enabling covert meetings, recruitment, and the transfer of sensitive information across borders. “To successfully counter these hostile activities in Europe, we need to restrict the movement of accredited diplomats from Russia and Belarus within the Schengen area,” BIS director Michal Koudelka declared in a statement published by multiple news outlets, including the Associated Press and AFP.
At the center of the case stands Alexandru Bălan, a former deputy head of Moldova’s Intelligence and Security Service (SIS) and later a diplomat at the Moldovan Embassy in Kyiv. Bălan, who possesses both Moldovan and Romanian citizenship, was arrested in Romania on September 8, 2025, on suspicion of high treason. Romanian prosecutors allege Bălan passed classified Romanian state secrets to Belarusian intelligence officers starting in 2024, meeting twice in Budapest, Hungary, to transmit instructions and receive payments for his services. The Moldovan Intelligence and Security Service confirmed Bălan’s detention to the Moldovan press, and his arrest was supervised by Eurojust, underscoring the transnational nature of the threat and the response.
According to Romania’s anti-organized crime agency DIICOT, the 47-year-old suspect’s actions “would likely endanger national security.” The meetings in Budapest, investigators say, were not chance encounters but carefully arranged exchanges involving the transfer of instructions and payments—classic hallmarks of espionage tradecraft. DIICOT’s statement, echoed by Czech and Hungarian officials, points to a pattern of continuous transmission of state secrets, making the case all the more alarming for European security officials.
But Bălan’s record of controversial activities stretches back years. Moldova’s former Defense Minister Anatol Salaru, speaking to Romanian media, described Bălan as “the main anti-Romania figure in Moldova’s SIS,” accusing him of recruiting Bessarabian students in Romania for intelligence purposes, orchestrating bribery schemes, and protecting criminals. Most notably, Bălan played a role in the 2018 kidnapping of Turkish teachers from a Turkish-Romanian high school in Chișinău. The teachers were seized off the streets, flown to Turkey at the request of President Recep Tayyip Erdoğan, and immediately jailed—an episode that left families shattered and raised international outcry over Moldova’s complicity.
The latest revelations, however, shine a harsh light on the vulnerability of diplomatic postings during times of conflict. After leaving Moldova’s intelligence service, Bălan’s appointment as a diplomat in Kyiv now appears in a new, troubling context—one that underscores how compromised officials can pose risks not just to their home countries but to the entire region. As the Czech Foreign Ministry bluntly stated, “We will not tolerate the abuse of diplomatic cover for intelligence activities.” On September 8, 2025, Prague declared a Belarusian embassy employee working for the KGB persona non grata and ordered their expulsion, granting the individual just 72 hours to leave the country.
These expulsions and arrests, while dramatic, are just the tip of the iceberg. The spy network’s exposure comes as Belarus, under the authoritarian leadership of President Alexander Lukashenko, deepens its alignment with Moscow. Since February 2022, Lukashenko has allowed Russia to use Belarusian territory as a launchpad for its full-scale invasion of Ukraine, later approving the deployment of Russian tactical nuclear missiles on Belarusian soil. According to The Kyiv Independent and other sources, these moves have made Belarus an indispensable cog in the Kremlin’s broader strategy to undermine security across Eastern Europe and destabilize Ukraine’s allies.
The case also highlights the persistent challenge posed by diplomatic immunity and the Schengen area’s open borders. Intelligence officials from the Czech Republic and other affected countries have repeatedly warned that hostile actors exploit these freedoms to advance their agendas. Czech Foreign Minister Jan Lipavský echoed these concerns, stating, “Agents covered by diplomatic privileges must not have free rein across Europe. I will continue to push at the European level for the relevant restrictions, primarily against Russian diplomats.”
The scale of the operation and the international cooperation it required have drawn praise from European security officials. Eurojust emphasized “the importance of transnational cooperation in investigating such malicious activities,” a sentiment echoed by BIS and Romania’s DIICOT. The investigation’s success, officials argue, demonstrates the necessity of coordinated action and information-sharing among European states, especially as Russian and Belarusian intelligence agencies adapt their tactics and seek new opportunities amid the ongoing conflict in Ukraine.
The network’s dismantling also comes against a backdrop of heightened vigilance. Earlier in 2025, Czech authorities expelled Belarusian journalist Natallia Sudliankova, accusing her of working for Russian secret services and writing articles that undermined public trust in the legitimacy of EU sanctions imposed on Russia after the Ukraine invasion. According to BIS’s annual report, Sudliankova’s activities were part of a broader campaign to sway public opinion and weaken European resolve in supporting Ukraine.
For many in Eastern Europe, the events of September 2025 serve as a sobering reminder that the region remains a battleground not just for armies, but for spies, influence operations, and covert alliances. The exposure of the Belarusian spy network is a victory for European counterintelligence, but officials caution that the threat is far from over. As long as diplomatic cover and open borders offer opportunities for hostile actors, the continent’s security will depend on vigilance, cooperation, and a willingness to confront uncomfortable truths about the nature of modern espionage.
With the shadow of Moscow looming ever larger, and Belarus’s role as a Kremlin proxy increasingly clear, European governments face tough choices about how to balance openness with security. The lessons of this case are likely to reverberate for months, if not years, as policymakers weigh new restrictions and the intelligence community braces for the next move in an ongoing, high-stakes game of cat and mouse.
