A Cuban dance teacher based in Russia is suspected of recruiting and coordinating the former Colombian military sent to Romania to set fire to several targets in Bragadiru. The attack, which could have affected the gas supply for around 25,000 consumers, was thwarted by the Romanian authorities.
The attack planned in Romania was part of a broader sabotage campaign that targeted multiple European countries. The same network is suspected of organizing arson, attempted attacks, and reconnaissance missions in Poland, Czech Republic, and Lithuania. Recruits were found on Facebook and Telegram, initially paid to photograph various targets, then sent to set them on fire.
The information comes from an investigation conducted over several months by DW, the Spanish public television RTVE, LRT from Lithuania, and ČT from Czech Republic. Journalists analyzed confidential court files, official documents, databases obtained from leaks, and content from social networks. They also spoke with security authorities and individuals involved in the investigations.
Who is the dance teacher
The network coordinator has been identified as Oemis Ramagoza Durruthy (left photo), a Cuban residing in Russia for at least seven years and holding Russian citizenship.
For several years, he had a public life related to dance. He worked as a bachata and salsa teacher in Petrozavodsk and was associated with the Made in Cuba studio.
Online, he allegedly used several identities: "Dios," "Dios 111," "Adrian Zans," "Ismael Zans," and "Roma Martinelli." Through them, he reportedly sought individuals from Latin American communities willing to work in Europe or go fight in Ukraine.
According to the investigation, Ramagoza recruited at least 12 people in 2024, most of whom spoke Spanish. Among them were former military personnel, migrant workers, and individuals facing financial difficulties.
"The investigation shows how Russian intelligence services operate beyond borders and continue to target new groups for their sabotage campaigns," said Mathias Bölinger, coordinator of the DW investigative team.
The former military sent to Romania
The person recruited for the operation in Romania is Luis Alfonso Murillo Diosa (right photo), a Colombian citizen who served in his country's armed forces between 2009 and 2015.
In March 2024, Murillo joined Facebook groups for individuals interested in going to fight in Ukraine. There, he was contacted by "Adrian Zans," after which the conversation moved to a private Telegram group, where the pseudonym "Dios" appeared.
According to RTVE, both identities belonged to the Cuban dance teacher. Documents analyzed by journalists indicate that Murillo had financial problems and was looking for a way to earn money.
He was offered money to come to Romania, identify the targets, take photographs and videos. The plane tickets, accommodation, and other expenses were paid in advance.
Murillo traveled from Medellín to Madrid, then to Mykonos, and finally to Bucharest, arriving in Romania on July 28, 2024.
What was supposed to be set on fire in Bragadiru
The targets were located in the Bragadiru area, near a complex where there was a recycling materials depot, two oil extraction wells, and a natural gas regulation and measurement station.
Murillo received maps and screenshots indicating the targets' locations, as well as access and retreat routes. On July 29, 2024, he surveyed the area, and the following night, he returned to continue his mission, at which point he was identified by the Romanian authorities.
He was to receive $1,500 for photographs and videos and an additional $1,500 for setting the targets on fire and recording the attack.
The consequences could have been much more severe than the amount offered. According to RTVE, investigators estimated that an attack on the gas network could have affected the supply to nearly 25,000 consumers, including educational institutions.
The sabotage did not take place. Meanwhile, Murillo has been sentenced in Romania to six years in prison.
What SRI established
The Romanian Intelligence Service announced as early as January 2025 that the operation was organized from Russia and that Murillo was part of an extensive network of saboteurs operating in several European countries.
According to the SRI statement, the Colombian had received pre-established instructions and photographs clearly indicating the targets. He was to document each stage and send images to the coordinators confirming compliance with the instructions.
SRI explained that the intermediary organizing the operation recruited individuals on social networks, purchased tickets, paid for accommodation, and transmitted the mission, destination, and targets through encrypted applications.
The photo-video documentation was also intended for propaganda campaigns. After Murillo's apprehension, Russian Telegram channels falsely claimed, using images from other fires, that a "logistics center" with fuel destined for Ukraine had been destroyed in Bragadiru.
In reality, the attack was thwarted. The propaganda used images of a fire caused by a short circuit in the locality of Bragadiru in Teleorman County, deliberately confused with the town of Bragadiru in Ilfov County.
From photographs to arson
Recruitment often started with seemingly mundane offers. The contacted individuals were offered between 100 and 300 euros for photographing a building or for a trip. If they completed the first task, they gradually received more dangerous missions.
After the initial contact on Facebook, discussions moved to Telegram, where more precise instructions were transmitted. For the Prague attack, for example, a recruit was paid $3,000.
These individuals are described as "single-use agents." They are not professional spies, do not know the entire network, and can be abandoned immediately after completing the mission or if they are arrested.
"If someone from a third country can do the job efficiently and cheaply, there are few reasons for Russia not to use them," explained Keir Giles, a Russia expert at Chatham House.
Attacks in multiple European countries
The network is suspected of organizing the arson of two construction material companies in Poland and buses at a depot in Prague. In Lithuania, several individuals attempted to set fire to equipment intended for the Ukrainian army.
The Lithuanian target was the TVC Solutions company in Šiauliai, where there were 19 mobile stations for radio spectrum analysis, which could be used for drone detection. The equipment stored there was valued at approximately 1.5 million euros.
The operation was divided among several individuals: some researched the target, others purchased flammable materials, and another person was sent from Russia to verify the attack's result.
Nine of the individuals recruited by Ramagoza are in custody in the EU, and two have been convicted. At the request of Lithuanian prosecutors, the Cuban dance teacher has been placed on an international wanted list.
Prosecutors link the operations to the GRU, the Russian military intelligence service. Ramagoza is described as a significant intermediary who recruited people, organized trips, booked accommodations, and transmitted instructions.
Public documents, however, do not demonstrate that he led the entire network or made decisions regarding target selection. Investigators describe a multi-level system designed so that the operatives do not know who is at the top of the command chain.