The Ukrainian Foreign Intelligence Service published a report on Friday detailing the methods used by Russian intelligence agencies—mainly the GRU and the FSB—to recruit socially vulnerable individuals and employ them in sabotage operations against defense industries and other strategic infrastructures in Europe.
These actions are part of a hybrid warfare campaign documented by InformNapalm, which has already recorded over 180 incidents since the beginning of the Russian invasion of Ukraine.
The recruitment mechanism primarily operates through social media platforms such as Facebook and Telegram, as well as job platforms.
Recruiters offer seemingly minor tasks—photographing buildings, placing stickers—that gradually escalate into arson, explosions, and surveillance of military or industrial targets.
The executors are instructed to record their actions and send the evidence to a coordinator in Russia, material that serves both as operational verification and input for propaganda campaigns.
One of the most revealing cases of this network directly involves Cuban citizens.
Oemis Romagoza Durruthy, born in Camagüey and residing in Petrozavodsk (Russia), where he worked as a salsa and bachata instructor at a studio called «Made in Cuba», is believed to have coordinated for the GRU a network of at least 12 people —mainly Latin Americans— who carried out sabotage operations in Poland, the Czech Republic, Romania, and Lithuania between May and September 2024.
The attacks attributed to this network included fires at two construction material businesses in Poland, a bus garage in the Czech Republic, a recycling facility in Romania, and equipment intended for Ukraine at a Lithuanian company. The Bucharest Court of Appeal issued an international arrest warrant against Romagoza on November 2, 2026.
The U.S. Department of Justice formally charged five members of the so-called "RIS Network": Romagoza, the Cuban Yaidel Delgado Suárez (alias "Viking"), former Russian officer Yuri Khromeev, his son Kirill Khromeev —described as an FSB officer— and the Venezuelan Ángel Eduardo Castro.
The charges include conspiracy to finance terrorism and, against three of them, conspiracy to commit murder, including that of the former world chess champion and opponent of Vladimir Putin, Garry Kasparov, a resident of New York, who received special protection after being warned of the threat during the summer of 2026.
The network allegedly offered up to $25,000 for a murder and began recruiting hitmen in 2025. The Cuban regime officially denied any links to the RIS Network but did not offer cooperation with the investigations.
The analysis by InformNapalm emphasizes that the fires caused are not only tools of physical destruction but also instruments of informational pressure.
In the case of the attacks on the OBI store in Warsaw and the Marywilska 44 shopping center, the perpetrators filmed the flames by express instruction from their coordinators: "the video recording of the fire was not an incidental event accompanying the crime, but rather part of the task."
This sabotage war also has a bidirectional dimension. While Moscow intensifies attacks on the European defense industry—with documented fires at Milrem Robotics (Estonia, August 2026) and at facilities near CARFIL SA (Romania, September 2026)—the OSINT database InformNapalm Fire records an unprecedented rise in acts of sabotage within Russian territory itself: 242 incidents in the incomplete year of 2026, a figure that exceeds the total for all of 2025 by 87.6% and surpasses the sum of the previous two years combined.
The researcher at the Swedish Institute of Eastern European Studies, Minna Alander, warned in October that "classical military deterrence is not suitable for sabotage deliberately orchestrated below the threshold of an open armed conflict," and called for sustained measures that gradually increase the cost for Moscow.
In the same vein, the European Council on Foreign Relations proposed in March 2026 to shift from a defensive model to an offensive strategy for the hybrid age that combines counterintelligence, sanctions on financial networks, and support for Ukrainian capabilities.
Related videos:
Filed under: