Russian Sabotage Network Uses Colombian Recruits Across Europe

A Colombian man, recruited by an online contact known as "Dios," embarked on a mission that ultimately led to his imprisonment in Romania. This incident is part of a larger pattern of sabotage across Europe, orchestrated by Russian intelligence services. DW, along with three other European broadcasters, uncovered classified documents and interviewed numerous sources, including investigators and secret service officials, to piece together this intricate story of espionage.

The Polish Arson Attacks

The chain of events began on the night of May 23rd on the outskirts of Warsaw, Poland. Security personnel discovered a fire at a construction supply business. The fire, which involved a stash of panels, was extinguished before it could cause extensive damage, though there was a significant risk to nearby vehicles.

Just a week later, a similar incident occurred in Radom, about 100 km from Warsaw, again at a construction supply business. A video of this fire surfaced online, with a Russian pro-war Telegram channel falsely claiming that military goods destined for Ukraine had been set ablaze by Ukrainian nationalists seeking revenge against Polish authorities. However, Polish secret services suspected Moscow was behind these fires.

According to Jacek Dobrzyński, spokesperson for Polish special services, the Russians specifically chose these locations and intended to film the fires at night to use the footage for propaganda purposes, making it difficult to discern what was actually burning.

The Colombian Recruit

Polish authorities identified a suspect: 26-year-old Andres de la Ost de la Cruz, a Colombian who had served in his country's army. He had been seeking work in Europe and connected with someone using the aliases "Adrian" or "Dios" through online job groups. Dios instructed him to set fire to a construction supply business, falsely claiming the owner wanted to collect insurance money, thereby concealing Russian intelligence's involvement.

De la Ost de la Cruz fell victim to a known Russian recruitment tactic. Initially, he was asked to take photos of various objects, a seemingly innocent task. This is often the first step for Russian services to recruit individuals, who are then either paid or blackmailed into further cooperation. The threat of being exposed for working with a foreign intelligence service, even unknowingly, is used to compel continued assistance.

De la Ost de la Cruz was later arrested in Czechia after starting another fire in Prague. He expressed deep remorse, stating he felt guilty for disappointing his family and for not being able to see his children grow up. This marks the first publicly documented case of a Latin American committing such acts on Russia's behalf.

A Wave of Sabotage Across Europe

Since at least 2023, Europe has experienced a surge in sabotage incidents attributed to Russian secret services: * A shopping center burned down in Warsaw. * Incendiary packages were found at logistics hubs. * An arson attack occurred at a warehouse in London. * Passenger trains were derailed in Poland. * A drone with explosives was found at a German airport.

The motive behind these attacks remains a puzzle for investigators and scholars. Daniela Richova, who researches Russian warfare, suggests these actions aim to: * Waste the resources of Western security and law enforcement agencies. * Spread chaos and paranoia among the general population, leading them to question their governments' ability to ensure their safety.

Richova notes that this tactic is reminiscent of Cold War Soviet strategy, emphasizing that these are long-term operations designed for compounded impact over time, rather than immediate results.

Another Colombian Recruit: Luis Alonso Morio Diosa

Dios's next recruit was Luis Alonso Morio Diosa, a 34-year-old from Caicedo, Colombia. Morio, from a family of coffee farmers, was in debt and seeking better financial opportunities. He had served in the Colombian army for six years.

In June 2024, Morio posted in a Facebook group for Latin Americans interested in joining the Ukrainian army, inquiring about salaries and travel expenses. Many Colombians, experienced in armed conflict, have joined Ukrainian foreign battalions due to high unemployment and attractive salaries. Sora Mloud, an international law expert, highlights how recruiters exploit the financial needs of Colombian veterans.

Dios contacted Morio privately, offering him a job and advising him against going to Ukraine. Morio, promised several thousand euros, joined a Telegram group called "Elite." Dios arranged his travel to Bucharest, Romania, covering tickets, taxis, and hotels.

In Bucharest, Dios instructed Morio to photograph a recycling company and a nearby oil well. Court documents indicate they discussed buying materials to start a fire, but Morio never acquired them. While gathering more images at night, Morio was stopped by police, becoming the second Colombian detained for working with Dios.

Kier Giles, an expert on the Russian military, notes that Russia is "entirely undiscriminating" in its recruitment, using individuals who may or may not be aware they are working for Russia. He explains that after many Russian diplomats suspected of espionage were expelled from European countries in 2022, Russia began recruiting "disposable agents" to fill the void. These agents, often non-Russians like Ukrainian migrants, drug dealers, or local youth seeking quick money, allow Russia to cause damage without significant repercussions if detected.

The Lithuanian Target: TVC Solutions

Despite the arrests, Dios continued his operations. The next agent, traveling from Russia on a Colombian passport, arrived in Lithuania. This time, the target had clear military value: TVC Solutions, a company producing broadcasting equipment, had a special order for the Ukrainian army – trailers equipped to analyze radio signals and detect enemy drones. These units were valued at €1.5 million.

Dios again arranged accommodation and transportation for the agent, a 20-year-old Colombian named Gonzalo R, who had grown up in Russia. Gonzalo R's mother stated he was seeking a way out of Russia to avoid military conscription and was unaware of the true nature of Dios's offer. His task was to document the property. After this reconnaissance mission, Gonzalo R left Lithuania and was arrested months later.

Dios then sent another agent, 59-year-old Myrael, a Cuban-Spanish dual citizen living in Russia. She crossed into Lithuania from Russia's Kaliningrad region on a Spanish passport. Her task was to photograph TVC Solutions and the trailers. After completing her mission, she returned to Russia.

Following these reconnaissance missions, Dios prepared for an attack. Two men from Spain were instructed to buy motor oil and gasoline, which they mixed in a water bottle. They attempted to set fire to TVC Solutions but were startled by a passing police car and fled, leaving the flammable materials behind. They were arrested hours later.

The GRU Connection and Dios's Identity

Investigators in at least five European countries were pursuing Dios. The complexity of the operations, involving individuals of various nationalities operating in different countries under instructions from a fourth, made investigations challenging.

The Lithuanian prosecution publicly attributed these actions to the Main Intelligence Directorate (GRU) of the General Staff of the Russian Armed Forces. Matias, a military historian specializing in the GRU, explains that while the GRU traditionally focused on intelligence gathering, it has increasingly engaged in physical sabotage. Its recruits are often special forces soldiers accustomed to executing orders without question. Western intelligence attributes most of Russia's recent sabotage to the GRU, with direct or tacit approval from President Putin.

Despite the arrests, Dios continued. Classified Lithuanian documents show that the next agents, a young Belarusian living in Spain and a young Russian, arrived from Switzerland to finish the job. A security camera captured one of them starting a fire, which caused no significant damage. They photographed the flames and left.

Lithuania placed three individuals on an international wanted list. Documents and sources from several countries confirmed that "Dios" is Os Romagosa Doti, a Cuban-Russian citizen originally from Camagüey, Cuba, who lived in Petrozavodsk, Russia. Romagosa, a professional dancer and salsa instructor, obtained Russian citizenship after marrying a Russian woman. He and his wife are listed as contacts for a dance studio in Petrozavodsk.

It is unclear how Romagosa became involved with Russian secret services, but leaked data suggests he faced financial difficulties by 2023, appearing in credit lender databases and working for a supermarket chain. In March 2024, Romagosa joined Facebook groups for Latin Americans seeking jobs in Europe or wanting to fight in Ukraine, and Telegram accounts linked to him posted job ads, setting traps for "disposable agents."

While Romagosa's actions failed to cause substantial material damage, several European authorities are still dealing with the aftermath, and those he lured into Russia's plot will face long-term consequences.