On social networks, the man is called “Adrian“ or “Dios“ (“God“ in Spanish - ed.). In 2024, profiles associated with him published job advertisements on Telegram. “People with military experience for surveillance, intelligence, logistics and tactical tasks are wanted”, states, for example, an ad in Spanish in a group for Latin Americans. The payment is also indicated - $ 1,500 plus a bonus for each completed operation.
As the investigation conducted by DW and three other European media outlets showed, Dios recruited people to carry out sabotage in the interests of Russia in at least four EU countries. Most of the people he recruited were from Spanish-speaking countries.
For several months, the participants in the investigation conducted dozens of conversations with representatives of the special services and people from the suspects' entourage. Comparing secret court documents, official statements, posts on social networks and leaked data, the journalists revealed who Dios is and how he created a network of saboteurs to organize arsons throughout Europe. But not all the tasks assigned were completed.
Recruitment of socially vulnerable people
One of Dios' recruits was Luis Alfonso Murillo Dios, who was 34 years old at the time. Murillo, a native of Caicedo, a provincial town in western Colombia, grew up in a family of coffee farmers. He served for six years in the Colombian army, which he left in 2015. In early 2024, Murillo decided to join the ranks of the Ukrainian army because he learned that foreign fighters there could receive several thousand euros a month for participating in combat operations. First, he joined a Facebook group for Latin Americans willing to fight in Ukraine. That's when he was contacted by a man nicknamed "Dios."
“Vulnerable people are often targeted,“ says Daniela Richterova, an intelligence researcher at King's College London. “Vulnerable people who need money; they are ready to go on a journey to make money without asking questions about what exactly they will have to do.“
Arrested for attempted sabotage
According to secret court documents obtained by DW, Dios introduced himself as a member of a special group and offered Murillo, instead of traveling to Ukraine, to take on “special tasks“ in Europe.
Muriillo accepted the offer, and Dios organized everything remotely: plane tickets, accommodation, ground transportation. They never met in person. When Murillo arrived in Bucharest in July 2024, “Dios” sent him a satellite photo showing oil rigs and a waste processing plant. Murillo was supposed to take photos and videos of these sites and then set them on fire. But he was detained at night near the waste processing plant after he had already taken the photos.
According to the case file, Murillo told investigators that he had no intention of committing arson, but was just trying to get to Ukraine. He claimed that he did not know who he was working for. In 2025, Murillo was sentenced to six years in prison for attempted sabotage.
The Russian disposable agents
The investigation has established that Murillo was one of at least a dozen people recruited by “Dios“ to carry out sabotage operations throughout Europe. Such recruits are often called “one-day agents“ or “disposable agents“. They are often recruited online, and it is not uncommon for them to know neither the sponsors nor the true goals of the tasks assigned to them.
According to conflict expert Cyrus Giles, who has authored several books on the Russian military, the Kremlin has increasingly resorted to the services of such agents after EU governments, in response to Russia's large-scale invasion of Ukraine in 2022, expelled numerous Russian diplomats suspected of espionage and disinformation.
“This created a gap in Russia's capabilities. It took time for it to find a new way to recruit random people to carry out attacks that sometimes seem completely random“, Giles notes. In 2024 alone, “one-day agents“ committed sabotage in several countries, including against a shopping mall in Poland and an “Ikea“ store in Lithuania. In the same series of sabotage acts is the revealed attempt to attack Leipzig/Halle airport with a drone full of explosives, the target of which was a Ukrainian cargo plane.
The suspected perpetrators are often not Russian citizens and have no obvious ties to Russian special services. Those charged so far include Ukrainian refugees, petty criminals, and young people looking to make a quick buck.
Russian arson attacks with a Cuban imprint
Among the actions ordered by “Dios“ in 2024 were the arson of construction materials warehouses in Poland, a bus fleet in the Czech Republic, a waste processing plant in Romania, and the burning of a Lithuanian equipment factory destined for Ukraine, the investigation shows.
The Lithuanian prosecutor's office has publicly linked this series of arson attacks to Russian military intelligence. In addition, law enforcement agencies have put a Cuban citizen residing in Russia on the international wanted list. And investigative journalists managed to reveal that behind the pseudonym “Dios“ is the Cuban citizen Oemis Romagoza Durruthy.
Romagosa was born in Cuba, but has been living in Russia for at least 7 years. There, he taught Latin American dances - in the city of Petrozavodsk. His name appears on the website of the local dance studio “Made in Cuba”. In 2022, Romagosa married a Russian woman and subsequently received Russian citizenship.
DV was unable to establish when and under what circumstances he began working for the Russian special services. Romagosa may have had financial difficulties: in 2023, he took out loans from various creditors, according to leaked information. A few months later, Romagosa joined Facebook groups of Latin Americans looking for work in Poland or ready to fight for Ukraine. Around the same time, “Dios“ began posting recruitment ads on Telegram.
Russian subversive activity continues
It is unclear whether “Dios“ continued to recruit people and organize new attacks after September 2024. However, Russian subversive activity throughout Europe continues. In August alone, two people were arrested in Latvia on suspicion of arson at a factory in Tallinn that supplies unmanned military aircraft to Ukraine. And Poland reported fires at two more facilities where components for drones and helicopters are manufactured. Authorities in both countries suspect Russia is behind these actions.
“It seems that there are still people who are either quite naive or obsessed with profit and motivated by the financial reward for such activity“, said intelligence expert Richterova.
At least nine disposable agents recruited by Romagosa have already been detained. Two of them are already serving prison sentences of six to eight years - for attempted sabotage or terrorist acts. The rest are currently awaiting trial.
Meanwhile, European authorities continue to search for Romagosa, who is probably still in Russia. In April, the dance studio “Made in Cuba“ published a video of him giving a salsa lesson. Around the same time, Romagosa joined at least two other Facebook groups for Latinos looking for work in Poland. The investigation team sent several inquiries to Oemis Romagosa Durruti, to which he has not yet responded.
Authors: Matthias Böllinger | Juliette Pineda | Anna Chaika