A joint investigation by Deutsche Welle, Lithuania’s LRT, Czech Television and Spain’s RTVE identified Oemis Romagoza Durruthy, a Cuban-born dance instructor living in Petrozavodsk, as the man behind the aliases “Dios” and “Adrian.” From Russia he directed a loose network of mostly Latin American recruits to carry out arson and reconnaissance against targets in Poland, the Czech Republic, Romania and Lithuania during a four-month stretch in 2024. Lithuanian prosecutors publicly linked the campaign to Russia’s military intelligence service, the GRU, and placed Romagoza on an international wanted list. He remains at large and is believed to be in Russia. The case is a textbook illustration of how Russian hybrid operations function after 2022: cheap, deniable, and designed to exploit people who need money more than they understand the mission. A dance teacher with two lives Romagoza was born in Camagüey, Cuba. He has lived in Russia for at least seven years, married a Russian woman in 2022, obtained Russian citizenship, and taught salsa, bachata and kizomba at a studio called Made in Cuba. Videos of his classes show him leading groups in front of a mirror. In April 2026 – after he had already been named by Lithuanian authorities – the studio posted another video of him teaching. Investigators found no public explanation of when or how he began working for Russian services. Leaked data suggested he faced financial pressure in 2023. Online he used different names and posted job ads on Telegram and Facebook. One Russian-language post in a Poland work group offered photography work. Another, in Spanish-language groups for Latinos and Cubans in Russia, sought people with “military experience in monitoring, intelligence, logistics and tactical maneuvers” and promised $1,500 plus a bonus per completed operation. Recruits were often young, short of cash, or looking for a way to reach Ukraine. Some had military backgrounds. Most did not know who they were ultimately working for. Disposable agents, remote control This is the core of the method. After European countries expelled large numbers of Russian diplomats following the full-scale invasion of Ukraine, Moscow lost many of its traditional intelligence officers on the ground. The response was to recruit “disposable agents” – amateurs hired online who could be directed remotely, paid little, and abandoned if caught. Intelligence researchers describe the approach as low-cost and high-deniability. Detection itself becomes part of the message: Russia can reach into European cities without sending uniformed officers. Romagoza organized travel, hotels and tasks from a distance. Recruits received satellite images of targets and instructions to photograph sites or start fires. Not every assignment succeeded. Authorities arrested at least nine people connected to the network. Two received prison sentences of six to eight years. One documented case is Luis Alfonso Murillo Diosa, a 34-year-old Colombian who had served in his country’s army. Recruited after expressing interest in joining Ukrainian forces, he travelled to Romania in July 2024. Investigators say he photographed a recycling facility, oil wells and a gas station with the intention of setting them alight or destroying them. He was detained before he could act. In 2025 Romania’s Supreme Court upheld a six-year sentence for attempted sabotage. Murillo claimed he only wanted to reach Ukraine. In Lithuania the network targeted TVC Solutions in Šiauliai, a company producing mobile radio-spectrum analysis stations for Ukraine. Two arson attempts in September 2024 using flammable liquid failed. A mixed group of Colombians, a Spaniard, a Belarusian, a Russian and a Cuban woman were later detained; trials continue. Similar fires or attempted fires hit construction-supply businesses in Poland and a bus depot in the Czech Republic. Some targets were chosen because they supported Ukraine’s war effort; others appear selected for disruption and publicity. Why this model works for Moscow The operations cost little, require no sophisticated tradecraft from the people on the ground, and create headlines that amplify a sense of vulnerability. They sit below the threshold of open conflict while still imposing costs – security spending, political pressure, public anxiety – on countries helping Ukraine. European officials have recorded a sharp rise in suspected Russian-linked arson, parcel devices, drone incidents and infrastructure interference since 2023. The Cuban instructor’s network is one documented strand in a larger campaign that uses both professional officers and rented amateurs. Romagoza himself has not been arrested. European warrants have not produced extradition from Russia. In the months after the investigation became public he was still appearing in dance videos and joining new Facebook groups aimed at Latin Americans looking for work in Poland. The contrast is the point of the method: an ordinary-looking life in a provincial Russian city, a Telegram account, and a string of fires hundreds of kilometres away. That combination – plausible deniability plus visible disruption – is how this form of hybrid pressure is designed to operate. With DW and LRT Caption: Oemis Romagoza Durruthy teaches Latin dance in northern Russia [Photo from his account in Vkontakte social media, the Russian version of Facebook]