Oemis Romagoza Durruthy: Lynchpin in a Major Russian Intelligence Operation

On November 5, Romania’s organized crime and terrorism prosecutors, DIICOT, announced that a judge at the Bucharest Court of Appeal had approved their request to place a 35-year-old Cuban national living in Russia under pre-trial arrest in absentia. The suspect is Oemis Romagoza Durruthy, born in Cuba in 1991, domiciled in the Russian Federation. Prosecutors allege that in June and July 2024 he paid a former Colombian soldier to scout strategic sites so they could be destroyed by explosion or fire. The offense is instigating acts of sabotage (“acte de diversiune”), a crime against national security under Romanian law.

Romagoza has lived in Russia for years working as a salsa dance instructor, became a Russian citizen, and, as such, Russia’s constitution bars his extradition. The prosecution still matters, though. Romania is now the third government to move formally against the same man in less than a year, after Lithuania and the United States, and it is worth reading what the paper trail adds up to.

Sabotage operations in 2024

Like most real intelligence operations, this one is complicated. The Colombian, Luis Alfonso Murillo Diosa, flew from Medellín to Madrid, then to Mykonos, and landed at Bucharest’s Otopeni airport on July 28, 2024. The next day he went to a site near Bragadiru in Ilfov County that held a recyclable-waste depot, two oil extraction wells, and a natural gas regulating and metering station. He photographed and filmed the targets and mapped routes in and out. According to Romania’s intelligence service, SRI, he arrived with a pre-set briefing and photographs of the targets already on his phone. Prosecutors said he had done his military service in Colombia and been trained in intelligence collection.

Police, with SRI support, stopped him before anything burned. DIICOT indicted him in November 2024 for attempted acts of sabotage. The Bucharest Court of Appeal sentenced him to six years in June 2025, and the conviction became final on September 22, 2025, when Romania’s High Court of Cassation and Justice dismissed his appeal.

One detail from the SRI’s account deserves more attention than it got. While the operation was still pending, pro-Russian channels were already presenting a successful act of sabotage in Bragadiru, crediting it to a supposed Ukrainian resistance group and illustrating it with images from other fires, including an unrelated accidental blaze. The claim went out even though the attack never happened. (Embarrassing!) For the people who commission these operations, the story of an attack can matter as much as the damage. After all, it’s about narrative.

Romagoza Durruthy’s four-country network

Romanian prosecutors did not treat Murillo as a lone actor. In March 2025, at Romania’s initiative and under Eurojust, they formed a joint investigation team with Czechia, Poland, and Lithuania, and later reported that the acts in all four countries were committed by people tied to the same organizers, using the same methods, toward the same objective. The public record since then fills in the map:

• Czechia. In June 2025, the Prague Municipal Court sentenced another Colombian to eight years for setting fire to buses in a Prague depot on June 6, 2024.
• Lithuania. In September 2024, two attempts were made to burn the premises of TVC Solutions in Šiauliai, which builds mobile radio-spectrum analysis stations for Ukraine’s armed forces. In January 2026, Lithuanian prosecutors charged six foreign nationals with terrorism offenses, finding reasonable grounds to believe the attempts were ordered by and carried out for Russia’s GRU. Romagoza is one of three fugitives on Lithuania’s international wanted list, alongside two other Cuban nationals.
• Poland. Construction-supply depots in Poland were targets of the same group.
• The United States. On September 15, 2026, the U.S. Attorney’s Office for the Southern District of New York unsealed charges against five people it describes as part of a network working for the intelligence services of the Russian Federation. The indictment alleges that Romagoza coordinated travel and logistics for that network, coordinated the June 2024 attack in Prague and a September 2024 attack in Lithuania, and in late 2025 obtained images of a home belonging to a prominent Russian dissident living in the United States. He is charged with conspiracy to finance terrorism. All five defendants remain at large, and the charges are allegations.

In September 2026, Romagoza was identified as the recruiter behind the online aliases “Dios” and “Adrian.” At least a dozen people were recruited from 2024 on. At least nine have been detained in the EU, and two are serving sentences.

The gig economy: espionage and sabotage sector

This cell worked like DoorDash, but for sabotage. Romagoza worked Facebook and Telegram groups where Latin Americans looked for jobs in Europe, offering cash to photograph or film industrial and commercial sites. Recruits never met him. Tickets, hotel bookings, and instructions arrived remotely, and later tasks escalated to buying materials for arson. The Šiauliai suspects were paid between €5,000 and €10,000.

The model follows from the mass expulsions of Russian intelligence officers from European embassies after the 2022 invasion of Ukraine. With fewer officers under diplomatic cover, Moscow rented strangers. The approach is cheap, deniable, and disposable: the person who strikes the match knows almost nothing about who ordered it. The Iranians are known for the same operational structure.

It also fails a lot. At least nine of the dozen or more known recruits have been detained. Murillo was identified before he acted, and passers-by spotted the Šiauliai attackers. The weak point is the reconnaissance phase, when an amateur has to stand near a target with a phone out, and that is exactly where Romanian authorities caught this operation. OPSEC, always!

Just because he’s Cuban doesn’t make this DGI

It is tempting to read “Cuban” in a headline and think of Havana. The public record does not support that leap, but it does not rule anything out either. Romanian, Lithuanian, and U.S. authorities all describe Romagoza as working for Russian services. None of the charging documents made public so far alleges direction from Cuba’s own service, the Directorate of Intelligence. He is a Cuban emigrant holding Russian citizenship, recruited into a Russian program.

Cuba’s intelligence service has its own long record against the United States, and it looks very different. Our guide to Cuban intelligence covers the cases that defined it: the Wasp Network in Florida, Ana Montes at the Defense Intelligence Agency, and former ambassador Víctor Manuel Rocha, who admitted serving Havana for decades. Those were operations built on trained officers and long-term penetrations. Romagoza’s network ran on strangers recruited through social media for one job each.

Where Cuba does enter this story is as a recruiting pool. Russia has spent years drawing Cubans into its orbit, including recruiters who offered Cubans money and citizenship to fight in Ukraine. Spanish-speaking emigrants with Russian residence are useful middlemen for reaching Spanish-speaking job seekers in Europe. At least four Cuban nationals now appear across the Lithuanian and U.S. cases. Whether Havana knows about, tolerates, or has any hand in that pipeline is an open analytical question, and a good indicator to watch is how Cuban authorities answer the requests for assistance these cases will generate. For the Russian side of the ledger, see our guide to Russian intelligence.

Why issue a warrant that can’t be served

Courts and prosecutors are doing most of the work against this network, and an in absentia warrant does several things even if no one ever executes it. It makes any trip outside Russia a risk for Romagoza. It puts his name and face on a police wanted list, which ends his value as an anonymous recruiter. It turns Romanian evidence into a court-tested record that partners in Prague, Vilnius, Warsaw, and New York can use. And it makes a point to the next person who answers a job ad on Telegram. The Colombian who took the money is serving six years in a Romanian prison, while the man accused of paying him was still appearing in his studio’s salsa videos from Karelia this spring. Anyone weighing that offer should know which of those two lives comes with the job.

Romania is not done with this kind of case. In October 2025, the SRI and DIICOT disrupted a plot to leave incendiary parcels at a Bucharest office of a Ukrainian courier company, and in September 2026 DIICOT detained a Russian citizen accused of surveilling Romanian military sites in preparation for hybrid sabotage.