On social platforms, this person calls himself "Adrian" or "Dios" (the latter means "God" in Spanish). In 2024, an account associated with the man posted a job ad on Telegram. One Russian-language message for a job opportunity in Poland read: "Work as a photographer." Another ad posted in a group for Cuban expats in Russia said: "If interested, please send resume, phone number and passport information." In addition, a group for Hispanics posted a recruitment message in Spanish, looking for people with experience in surveillance, intelligence, logistics and tactical exercises in the military, promising a reward of $1,500, plus additional bonuses for each completed operation.
An investigation by Deutsche Welle (DW) and three other European broadcasters found that Dios induced multiple people to carry out sabotage activities for Russia in at least four EU countries. Most of the recruits come from Spanish-speaking countries.
Over months, DW and its partners interviewed dozens of security officials and people close to the suspects. By pulling together undisclosed court documents, official statements, social media posts and leaked data, investigators revealed Dios' identity and how he built a network of saboteurs to plan and carry out arson attacks across Europe.
Not everyone completed their intended tasks.
Recruiting people who are easy to take the bait
One of the people Dios recruited was Luis Alfonso Murillo Diosa, who was 34 years old at the time. Murillo comes from Caicedo, a rural town in western Colombia known for its mountainous scenery and crop cultivation. He was born in a family of coffee farmers. According to a person familiar with the matter, the family was in debt due to several years of poor harvests.
Murillo served in the Colombian army for six years. Court documents show he was discharged from the Army in 2015. Since then, like many veterans, he has worked a variety of jobs, training as a barista and working as a bodyguard, while also taking care of his family's coffee business.
Court documents show that in early 2024, Murillo decided to join the Ukrainian army. There, foreign fighters sent to the front lines are paid thousands of euros a month.
To learn about the process, he joined a Facebook group for Latin Americans interested in traveling to Ukraine to fight. It was there that he came into contact with Dios.
"The people who are targeted tend to be vulnerable groups," said Daniela Richterova, associate professor of intelligence at King's College London. "These are people who are financially strapped, willing to travel for money, and often unwilling to understand the purpose of their mission."
Arrested for attempted sabotage
Unpublished court documents reviewed by DW show that Dios claimed to be a member of a "task force" in a private Facebook message and proposed that Murillo work with him on a "special mission" in Europe instead of traveling to Ukraine.
Murillo accepted the offer, and Dios arranged everything remotely, including flights, accommodations and ground transportation. The two have never met.
After Murillo arrived in Bucharest, the capital of Romania, in July 2024, Dios sent him a satellite image that marked a recycling facility and an oil well. Murillo was tasked with taking photos and videos of the locations and then setting them on fire. However, he was detained one night after taking photos near the recycling facility. Murillo told investigators he never intended to commit arson, according to court records. He claimed he was trying to travel to Ukraine via Europe and had no idea who he was working for.
In 2025, Murillo was sentenced to six years in prison for attempted sabotage.
Russia's "disposable agent"
DW and partners have confirmed that Dios recruited at least a dozen people across Europe to carry out sabotage activities, and Murillo was one of them. Such recruits are often called "disposable agents": they are often hired online, sometimes without even knowing the identity of their employer or the true purpose of the assignment.
Conflict researcher Keir Giles told DW that since Russia's invasion of Ukraine in 2022, EU governments expelled dozens of Russian diplomats suspected of espionage and spreading disinformation, and the Kremlin has increasingly used such "disposable agents" since then.
"This (the expulsion of Russian diplomats) created a gap in Russia's capabilities, and it took them some time to find this new way of recruiting ordinary people to carry out seemingly unrelated attacks," said Giles, who has written several military books on Russia.
In 2024 alone, these “disposable” agents burned down a shopping mall in Poland, set fire to an Ikea store in Lithuania, and delivered packages with incendiary devices that started fires in multinational logistics hubs. German authorities said the agents, also known as "throwaways," flew an explosives-laden drone in an attempt to attack a Ukrainian cargo plane at Leipzig Airport in August.
Suspects involved in such attacks are often non-Russian and have no known previous links to Russian intelligence services. Those prosecuted include Ukrainian refugees, criminals with minor criminal records or local young people trying to make a quick buck.
“Russia doesn’t have to cover its tracks because there are no negative consequences if it’s discovered,” Giles said. “Of course, it reinforces the image that Russia wants to project—that it’s omnipotent and can cause havoc anywhere, anytime.”
Remote-controlled arson in Europe
Deutsche Welle's investigation confirmed that during 2024, Dios directed recruits to carry out arson attacks on multiple targets within four months, including two building materials companies in Poland, a bus garage in the Czech Republic, a recycling facility in Romania, and equipment produced by a Lithuanian company that was destined for Ukraine.
Among the above-mentioned parties involved, only the Lithuanian prosecutorial agency publicly blamed the series of arson attacks on Russian military intelligence agencies. They also put a Cuban man living in Russia on an international wanted list.
After reviewing undisclosed court documents and dozens of leaked files, Deutsche Welle and its partners confirmed that Cuban citizen Oemis Romagoza Durruthy was the man behind the pseudonym "Dios."
Romogoza was born in Camaguey, Cuba's third largest city, and lived in Russia for at least seven years.
A Latin dance teacher in the northern Russian city of Petrozavodsk, Romogosa is the social media contact for a local dance studio called Made in Cuba. In dozens of online videos of him teaching dance classes, he demonstrates steps to Salsa, Bachata and Kizomba.
Romogosa married a Russian woman in 2022 and subsequently obtained Russian citizenship. One set of wedding photos DW found on social media showed the couple posing next to a grand piano; other photos showed them posing with their two children.
DW was unable to determine exactly when or how he began working for Russian intelligence services. Leaked data suggests Romogosa may have been in financial trouble at one point. In 2023, he borrowed money from multiple credit institutions; in one of the loan records, he listed a supermarket chain as his employer.
A few months later, Romogoza joined Facebook groups that brought together Latin Americans looking for work in Poland or interested in traveling to Ukraine to fight in the war. At the same time, Dios's account began to post recruitment information on Telegram.
The sabotage continues
It is unclear whether Dios continued to recruit or plot additional attacks after September 2024, but Russia's ongoing sabotage activities across Europe have not stopped.
In August alone, Estonia arrested two suspects in connection with an arson attack on a company supplying military unmanned vehicles to Ukraine, while Poland also reported fires at two facilities that produce parts for drones and helicopters. Authorities in both countries suspect Russia is behind the sabotage plots.
“It seems that there are still some people who are either naive and gullible or extremely greedy and motivated by financial gain to participate in such activities,” said Richterova, who specializes in Russian intelligence work.
At least nine of the "disposable" agents recruited by Romogoza have been arrested. Two of them have been sentenced to six to eight years in prison for attempted sabotage or terrorism; the remainder are currently awaiting trial.
Meanwhile, European authorities are still searching for Romogosa's whereabouts and he may still be in Russia. In April this year, his dance studio released a video of him taking a class. In the video, Romogosa faces the mirror and leads a group of female students to practice dance steps. A Cuban salsa song plays in the background, and the lyrics go: "Because that's who I am. In heaven, I'll be the boss."
Around the time the Latin dance studio posted the video, Romogoza joined at least two Facebook groups for Latin Americans looking for jobs in Poland. Romogosa Durruti did not respond to media requests for comment.
