Cuban Dance Instructor Accused of Directing Russian Sabotage Network Across Europe

A Cuban national living in northern Russia has been identified as the alleged coordinator of a network that recruited people to carry out sabotage and arson attacks in several European Union countries in 2024, according to an international investigation based on court records, leaked documents and interviews with people familiar with the cases.

The man, Oemis Romagoza Durruthy, reportedly operated under the names Adrian and Dios while recruiting individuals through social media and messaging platforms. Investigators say he organized assignments, travel arrangements and payments for recruits who were sent to European countries to photograph potential targets and, in some cases, set them on fire.

The investigation traced Romagoza to the Russian city of Petrozavodsk, where he has worked as a Latin dance instructor. His online presence includes videos of him teaching salsa, bachata and kizomba at a local dance studio known as Made in Cuba.

The network appears to have relied heavily on people looking for quick employment or struggling financially. Several recruits came from Spanish speaking countries and had little or no previous connection to Russian intelligence services.

One of the people allegedly recruited by Romagoza was Luis Alfonso Murillo Diosa, a Colombian former soldier. Murillo had served for six years in the Colombian army before leaving in 2015 and subsequently worked in a number of occupations, including security work.

In early 2024, Murillo was considering joining the Ukrainian military after learning that foreign volunteers could receive financial compensation for serving there. While looking for information online, he joined a Facebook group used by Latin Americans interested in fighting in Ukraine.

It was through that group that he was contacted by a person using the name Dios.

Instead of helping Murillo reach Ukraine, the individual offered him what were described as special missions in Europe. Court documents reviewed during the investigation indicate that the operation was organized remotely. Flight tickets, accommodation and transportation were arranged for Murillo, who never met the person directing him face to face.

After arriving in Bucharest in July 2024, Murillo allegedly received a satellite image showing a recycling facility and an oil installation. He was instructed to photograph and record the locations before eventually starting a fire.

Murillo was arrested while walking near the recycling facility after taking photographs.

During questioning, Murillo told investigators that he had never intended to carry out an arson attack. He said his objective had been to reach Europe and eventually travel to Ukraine and claimed he did not know the identity or true purpose of the people behind the assignment.

He was later sentenced to six years in prison for attempted sabotage.

The case has become part of a broader pattern that European security officials have linked to Russian efforts to conduct covert operations using people recruited online.

Security researchers often describe these individuals as disposable agents. They are typically recruited for individual assignments and may have little understanding of who ultimately employs them or what larger operation they are participating in.

The approach became increasingly important for Russian intelligence networks after European governments expelled numerous Russian diplomats and suspected intelligence officers following Russia’s full scale invasion of Ukraine in 2022.

With traditional intelligence networks under greater scrutiny, investigators say online recruitment has provided a way to find people willing to undertake dangerous assignments in exchange for money.

In 2024, a number of incidents across Europe were investigated as possible Russian linked sabotage operations. These included fires at commercial properties, attacks involving incendiary packages and other attempts to damage facilities connected to European logistics and military supply chains.

The suspected participants have frequently been citizens of countries other than Russia. Some have reportedly been Ukrainian refugees, young people, people with criminal backgrounds or individuals experiencing financial difficulties.

The alleged recruitment network associated with Romagoza operated across several countries.

During a period of roughly four months in 2024, recruits were allegedly instructed to target two construction supply businesses in Poland, a bus facility in the Czech Republic, a recycling site in Romania and equipment in Lithuania intended for Ukraine.

Lithuanian prosecutors publicly linked the attacks to Russia’s military intelligence service, commonly known as the GRU, and placed a Cuban national living in Russia on an international wanted list.

Investigators subsequently identified that man as Romagoza.

Born in Camaguey, Cuba, Romagoza has reportedly lived in Russia for at least seven years. His activities there appeared at first to be centered on Latin dance.

He became associated with the Made in Cuba dance studio in Petrozavodsk and appeared regularly in online videos teaching dance classes. His social media activity also showed a personal life that appeared to be firmly established in Russia.

Romagoza married a Russian woman in 2022 and later acquired Russian citizenship. Photographs found online show the couple together and with their two children.

However, leaked information examined by investigators suggests that he may have experienced financial difficulties before the alleged recruitment operation began. Records indicate that he borrowed money from several lenders in 2023. In at least one record, he listed a supermarket chain as his employer.

His online activity later changed. He joined Facebook groups used by Latin Americans searching for employment in Poland and by people interested in travelling to Ukraine to fight.

At roughly the same time, advertisements began appearing on Telegram offering various forms of paid work.

Some advertisements sought people with military backgrounds and experience in areas such as surveillance, intelligence, logistics and tactical operations. One offer reportedly promised a payment of about $1,500, along with additional money for each completed assignment.

Investigators say these recruitment methods were designed to find people willing to travel and carry out instructions without necessarily understanding the wider purpose of their missions.

The continuing investigation has raised questions about how Russian intelligence services identify and exploit people who are financially vulnerable or seeking opportunities abroad.

There is still uncertainty about whether Romagoza continued recruiting agents after September 2024 or whether he personally directed additional operations.

European authorities, however, continue to investigate suspected Russian sabotage activity.

In August, authorities in Estonia arrested two people over an alleged arson attack against a company supplying unmanned military vehicles to Ukraine. Poland also reported fires at facilities involved in manufacturing components for drones and helicopters. Investigators in both countries have examined possible Russian involvement.

At least nine people connected to the network allegedly recruited by Romagoza have been arrested. Two have received prison sentences ranging from six to eight years for offences involving attempted sabotage or terrorism, while others remain subject to court proceedings.

Romagoza remains wanted by European authorities and may still be in Russia.

Despite the international investigation, evidence indicates that he has continued appearing publicly in Russia. In April, the Made in Cuba dance studio posted a video showing him teaching a salsa class. In the footage, he stands at the front of a group and leads dancers through a routine.

Around the same period, investigators found evidence that he had joined additional online groups aimed at Latin Americans seeking employment in Poland.

Romagoza has not responded to requests for comment about the allegations.

The case illustrates the increasingly complex nature of covert sabotage investigations in Europe, where authorities are confronting operations that allegedly combine Russian intelligence direction with recruits who may have no established connection to Russia.

For European security agencies, the challenge extends beyond identifying the organizers. Detecting potential recruits before they carry out an assignment has become increasingly difficult when communication takes place through encrypted messaging platforms, social media groups and anonymous online job advertisements.

The alleged activities of Romagoza also demonstrate how individuals living apparently ordinary lives can become involved in international intelligence operations. In his public profile, he appeared primarily as a Cuban immigrant, Russian citizen and dance instructor. Investigators, however, allege that behind that public identity was a network that recruited people to conduct sabotage operations in multiple European countries.

Courtesy: amp.dw