Cuban dance teacher 'Dios' accused of Russia sabotage plot

Oemis Romagoza Durruthy teaches Latin dance in northern Russia

A Cuban dance teacher living in Russia has been identified as the man allegedly recruiting people to carry out sabotage attacks across Europe for Russia. Investigators say Oemis Romagoza Durruthy operated under the names “Adrian” and “Dios” — Spanish for “God” — while using social media to lure recruits with promises of cash.

A joint investigation by DW and three other European broadcasters found that Dios recruited at least a dozen people for sabotage operations in at least four EU countries. Most of those targeted were Spanish speakers, with job adverts offering payments of up to $1,500 plus bonuses for completed operations.

The recruitment campaign unfolded online in 2024. Telegram posts advertised work as a photographer and sought people with military experience in monitoring, intelligence, logistics and tactical manoeuvres.

The investigation involved dozens of interviews with security officials and people close to suspects, alongside classified court documents, official statements, social media posts and leaked data. Together, the evidence was used to reconstruct how the alleged network operated.

Murillo said he sought to join the Ukrainian army, not work for Russia

One recruit was Colombian former soldier Luis Alfonso Murillo Diosa, who was 34 when he became involved. Raised in Caicedo, western Colombia, Murillo came from a family of coffee farmers whose business had fallen into debt after several years of poor harvests.

Murillo spent six years in the Colombian army before leaving in 2015. He later worked various jobs, including as a bodyguard, while also taking barista courses and helping with his family's coffee business.

In early 2024, he decided to enlist in the Ukrainian army. While searching for information, he joined a Facebook group for Latin Americans interested in fighting for Ukraine.

That was where Dios found him.

According to classified court documents reviewed by DW, Dios introduced himself as part of a “special group” and offered Murillo “special missions” in Europe instead of Ukraine. Murillo accepted, and Dios remotely arranged his flights, accommodation and transport.

When Murillo arrived in Bucharest in July 2024, he was sent a satellite image marking a recycling facility and an oil well. He was instructed to photograph and film the sites before later setting a fire.

But the operation unravelled. Murillo was detained near the recycling facility after taking photographs, and told investigators he had never intended to carry out arson.

He said he had been trying to reach Europe so he could get to Ukraine and did not know who he was working for. In 2025, he was sentenced to six years in prison for attempted sabotage.

Investigators say Murillo was just one example of a wider recruitment system using so-called “disposable agents”. These people are often hired online, may not know who their employers are and can be unaware of the real purpose of their assignments.

Keir Giles, a conflict researcher who has written several books about Russia's military, said the Kremlin increasingly turned to such recruits after EU governments expelled scores of Russian diplomats suspected of espionage and disinformation following the 2022 invasion of Ukraine.

“That left a gap” in Russia's capabilities, Giles told DW, arguing that it took time for Moscow to develop a new method of recruiting people for attacks.

The pattern became visible across Europe in 2024. Disposable agents burned down a shopping centre in Poland, set fire to an Ikea store in Lithuania and delivered incendiary packages that ignited at logistics hubs in several countries.

The 2024 attack on a Warsaw shopping center has been attributed to disposable agents

German authorities also said throwaway agents steered a drone carrying explosives towards a Ukrainian freight plane in Leipzig in August.

The alleged recruits were often not Russian and had no known previous links to Russian intelligence. Prosecuted suspects included Ukrainian refugees, low-level criminals and local youths seeking quick money.

Giles said Russia did not necessarily need to conceal its involvement carefully because detection itself could serve another purpose — projecting an image of power and the ability to cause damage across Europe.

Over four months in 2024, Dios allegedly instructed recruits to target businesses and facilities in Poland, the Czech Republic, Romania and Lithuania. The targets included two construction-supply businesses in Poland, a bus garage in the Czech Republic, a Romanian recycling facility and equipment destined for Ukraine produced by a Lithuanian company.

Lithuanian prosecutors were the only authorities to publicly link the series of arson attacks to Russia's military intelligence service, the GRU. They also placed a Cuban man living in Russia on an international wanted list.

DW and its partners identified that man as Romagoza after examining classified court records and dozens of leaked files.

Born in Camaguey, Cuba's third-largest city, Romagoza has lived in Russia for at least seven years. He works as a Latin dance teacher in Petrozavodsk and appears on social media linked to the local Made in Cuba dance studio.

Videos show him teaching salsa, bachata and kizomba. Other social media material shows him with his Russian wife, whom he married in 2022, and their two children after obtaining Russian citizenship.

Exactly when or how Romagoza allegedly began working with Russian secret services remains unclear. Leaked data indicate he may have experienced financial difficulties after borrowing money from several credit lenders in 2023.

In one record, he listed a supermarket chain as his employer.

Months later, Romagoza joined Facebook groups used by Latin Americans seeking work in Poland or hoping to fight for Ukraine. Around the same time, Dios began advertising jobs on Telegram.

The alleged sabotage network has continued to cast a shadow over Europe even though it remains unclear whether Dios recruited further operatives or ordered more attacks after September 2024.

In August, Estonia arrested two suspects over an arson attack against a company supplying unmanned military vehicles to Ukraine. Poland also reported fires at two facilities manufacturing components for drones and helicopters, with authorities in both countries suspecting Russian involvement.

Lithuanian prosecution has added Oemis Romagoza Durruthy to an international wanted list

Daniela Richterova, an associate professor in Intelligence Studies at King's College London, said vulnerable people willing to travel for money could remain attractive targets for Russian recruitment.

At least nine of the disposable agents allegedly recruited by Romagoza have been caught. Two are serving sentences of between six and eight years for attempted sabotage or terrorism, while others are awaiting trial.

Romagoza remains wanted by European authorities and may still be in Russia. In April, the Made in Cuba studio posted footage showing him teaching a salsa class, leading women through dance steps as music played.

Around the same period, the studio posted the video, Romagoza joined at least two more Facebook groups for Latin Americans looking for work in Poland.

The striking footage has left a troubling question hanging over the investigation: was the dance teacher's online recruitment operation really over — or was it still moving beneath the surface?

Cuban dance teacher ordered EU sabotage attacks from Russia