Cuban dance teacher coordinated Russian sabotage network across EU in 2024

In the spring of 2024, a man using the online alias "Dios"—Spanish for "God"—began posting job advertisements across Telegram and Facebook groups frequented by Spanish speakers. The listings were simple and direct: work as a photographer in Poland, $1,500 per operation plus bonuses, no questions asked. What followed was a coordinated campaign of arson attacks across four European Union countries, orchestrated remotely by someone operating from inside Russia on behalf of the country's military intelligence service.

Luis Alfonso Murillo Diosa was exactly the kind of person Dios was hunting for. The 34-year-old Colombian had spent six years in his country's army before drifting through a series of low-wage jobs—barista work, bodyguard stints, helping manage his family's struggling coffee farm in the mountainous region around Caicedo. In early 2024, looking for a way to earn real money, he joined a Facebook group for Latin Americans interested in fighting for Ukraine, where foreign soldiers could make several thousand euros monthly. That's where Dios found him. In a private message, Dios introduced himself as part of a "special group" and offered Murillo something better than Ukraine: special missions in Europe, with all expenses covered. Murillo agreed without ever meeting his recruiter in person.

Dios handled everything remotely—booking flights, arranging housing, organizing ground transport. When Murillo arrived in Bucharest in July 2024, Dios sent him a satellite image showing a recycling facility and an oil well, with instructions to photograph and film the locations before setting them on fire. Murillo was arrested while taking photos near the recycling facility one night. He later told investigators he had never intended to commit arson and didn't know who he was actually working for. In 2025, he was sentenced to six years in prison for attempted sabotage.

Murillo was one of at least a dozen people Dios recruited across Europe. These operatives are known in intelligence circles as "disposable agents"—people hired online, often with no prior connection to any intelligence service, sometimes unaware of who is actually employing them or what the true purpose of their work is. Russia has increasingly relied on this model since 2022, when EU governments expelled scores of Russian diplomats suspected of espionage and disinformation following the invasion of Ukraine. That expulsion created a gap in Russia's operational capacity, and the Kremlin found a way to fill it: recruit desperate people from anywhere, give them money, and let them do the work. If they get caught, there's no obvious trail back to Moscow. If they succeed, Russia gets to demonstrate its reach.

In 2024 alone, disposable agents burned down a shopping center in Poland, set fire to an Ikea store in Lithuania, and delivered incendiary packages to logistics hubs across multiple countries. German authorities said throwaway agents steered a drone carrying explosives toward a Ukrainian freight plane in Leipzig in August. Over four months in 2024, Dios instructed his network to target two construction-supply businesses in Poland, a bus garage in the Czech Republic, a recycling facility in Romania, and equipment destined for Ukraine at a Lithuanian manufacturing company. Only Lithuanian prosecutors publicly attributed the attacks to Russia's GRU, the military intelligence service, and they placed a Cuban man living in Russia on an international wanted list.

That man is Oemis Romagoza Durruthy. Born in Camaguey, Cuba's third-largest city, Romagoza has lived in Russia for at least seven years. He works as a Latin dance instructor in Petrozavodsk, a city in northern Russia, and is listed as a contact person for a local dance studio called Made in Cuba. Videos of his classes show him teaching salsa, bachata, and kizomba to groups of students. In 2022, he married a Russian woman and obtained Russian citizenship. Wedding photos show the couple posing beside a grand piano, later pictures show them with their two children. Leaked financial data suggest Romagoza faced money troubles in 2023, when he borrowed from several credit lenders and listed a supermarket chain as his employer. A few months later, he joined Facebook groups for Latin Americans seeking work in Poland or looking to fight in Ukraine. Around the same time, Dios began posting his job advertisements.

It remains unclear whether Romagoza continued recruiting or directing attacks after September 2024, but Russia's sabotage campaign across Europe has not slowed. In August alone, Estonia arrested two suspects for arson targeting a company supplying unmanned military vehicles to Ukraine, and Poland reported fires at two facilities manufacturing drone and helicopter components. At least nine of the people Romagoza recruited have been arrested. Two are serving sentences of six to eight years. Others await trial. European authorities are still searching for Romagoza, who may still be in Russia. In April 2026, the Made in Cuba dance studio posted a video of him teaching a salsa class, facing the mirror as a group of women followed his steps. In the background, a Cuban salsa tune played: "Because that is what I am. In heaven, I am the chief." Around the same time, Romagoza joined at least two more Facebook groups for Latin Americans looking for work in Poland.