Cuban Instructor Allegedly Orchestrated EU Sabotage
A Colombian recruit who sought to join the Ukrainian army was instead directed by a Cuban dance teacher to conduct arson in Romania, according to a multinational investigation.
According to an investigation by Deutsche Welle and three other European broadcasters, a Cuban man known online as "Dios" coordinated a network of saboteurs across the European Union in 2024. The reports indicate that the individual, who operated from a Latin dance studio in Russia, directed recruits to commit arson attacks in at least four EU countries. These operations were allegedly conducted on behalf of Russian intelligence services, utilizing a remote command structure that kept the orchestrator physically distant from the acts of violence.
The investigation reveals that the recruiter targeted vulnerable individuals, often from Spanish-speaking countries, by posting job advertisements on social media platforms. These listings, shared on Telegram and Facebook, offered financial incentives for roles in photography, logistics, or tactical monitoring. The recruits, many of whom had military backgrounds or financial difficulties, were lured into carrying out tasks they believed were related to conflict support, only to be directed toward sabotage operations in Europe.
Recruitment Through Digital Channels
One prominent case involves Luis Alfonso Murillo Diosa, a Colombian former soldier who sought to enlist in the Ukrainian army in early 2024. According to court documents reviewed by the news outlet, Murillo joined a Facebook group for Latin Americans interested in fighting in Ukraine. There, he was contacted by Dios, who presented himself as a member of a special group offering alternative employment. The recruiter promised higher pay and easier travel logistics, effectively diverting Murillo from his initial goal of joining the front line in Ukraine.
Dios managed the operation remotely, arranging flight tickets, accommodation, and ground transport for Murillo without ever meeting him in person. Once in Bucharest, Romania, in July 2024, Murillo received satellite images marking specific locations, including a recycling facility and an oil well. He was instructed to document these sites and subsequently start a fire. However, he was detained while walking near the target, leading to his arrest and subsequent legal proceedings.
Legal Consequences for Recruits
Murillo was sentenced to six years in prison in 2025 for attempted sabotage. During his trial, he claimed that he did not know who he was working for and that his original intent was to reach Ukraine. This case highlights a broader pattern identified by investigators, where individuals are recruited as "disposable agents." These operatives are often hired online, provided with limited information about the true objectives of their missions, and left to act under the direction of anonymous handlers.
Security officials interviewed for the investigation noted that such tactics allow intelligence services to maintain plausible deniability. By using intermediaries who do not know the identities of their employers, the orchestrators can minimize their own exposure to legal risk. The use of vulnerable individuals, who may be driven by financial desperation or a desire for adventure, creates a layer of separation between the strategic command and the execution of the attacks.
Strategic Shift in Covert Operations
The reliance on disposable agents represents a strategic adaptation in the face of increased diplomatic pressure. As EU governments have expelled diplomats and intelligence officers involved in more direct espionage activities, the use of local or foreign recruits has become a more common tool for conducting sabotage. This method allows for the projection of influence and the disruption of infrastructure in host nations while complicating the attribution of responsibility to state actors.
The investigation underscores the growing complexity of security threats in Europe, where traditional state-on-state espionage blends with cyber-enabled recruitment and transnational criminal networks. As authorities continue to dismantle these cells, the focus remains on identifying the central nodes of coordination. The case of Dios and his network serves as a significant data point in understanding how modern hybrid warfare leverages social media and economic vulnerability to achieve geopolitical objectives.
