14-09-2026
An investigation by DW and three other European broadcasters identifies Oemis Romagoza Durruthy, a Cuban Latin-dance teacher living in Russia, as the person operating under the aliases “Dios” and “Adrian.” Investigators say he recruited at least a dozen people, primarily Spanish-speaking nationals, to conduct sabotage and arson operations in several European Union countries on behalf of Russia.
Romagoza used Telegram, Facebook and expatriate groups to advertise apparently legitimate jobs or offer lucrative “special missions.” Recruits were promised payments of around $1,500 plus bonuses and were often people facing financial hardship, including former soldiers, refugees and low-level criminals. One recruit, Colombian former soldier Luis Alfonso Murillo Diosa, believed he was seeking a route into the Ukrainian army. Instead, Romagoza arranged his travel to Bucharest and instructed him to photograph a recycling facility and an oil well before setting them on fire. Murillo was arrested and later sentenced to six years in prison for attempted sabotage.
According to the investigation, Romagoza directed recruits to target construction-supply businesses in Poland, a bus garage in the Czech Republic, a recycling facility in Romania and equipment destined for Ukraine in Lithuania. Lithuanian prosecutors have attributed the attacks to Russia’s military intelligence service, the GRU, and placed Romagoza on an international wanted list.
The report places these operations within Russia’s broader use of “disposable agents”—online recruits who may not know their employers or the true purpose of their assignments. Experts say Russia increasingly relied on such agents after European countries expelled suspected Russian intelligence officers following the 2022 invasion of Ukraine. Romagoza’s personal history includes migration from Cuba, Russian citizenship, a marriage and possible financial difficulties. It remains unclear whether he continued recruiting or organizing attacks after September 2024, although European authorities say sabotage linked to Russia has continued.
Entities: Oemis Romagoza Durruthy, Luis Alfonso Murillo Diosa, DW and partner European broadcasters, Russia, Russian military intelligence service (GRU) • Tone: analytical • Sentiment: negative • Intent: analyze
14-09-2026
German federal prosecutors have charged Ilona W., a 57-year-old Berlin businesswoman who holds German and Ukrainian citizenship, with allegedly carrying out intelligence activities for Russia. She was arrested on January 21 and remains in pre-trial detention; the charges do not constitute a conviction. Prosecutors accuse her of operating a Berlin marketing agency and chairing a lobbying association, positions that gave her access to military and political networks. According to the indictment, she had been in contact since at least October 2023 with a full-time Russian intelligence officer stationed at the Russian Embassy in Berlin. She allegedly provided him with information about prominent events and helped him gain access to them, sometimes using a false name. Prosecutors believe these efforts were intended to help the officer develop a network for intelligence operations.
Ilona W. is also accused of attending events to identify useful contacts and potential targets. Investigators say she attempted to recruit individuals from Germany’s Defense Ministry and the arms industry, while seeking information about German defense policy and the defense sector for her Russian contact. The alleged intelligence-gathering reportedly focused particularly on issues related to Russia’s war against Ukraine.
The Federal Prosecutor’s Office filed the charges last week with the state security division of Berlin’s Higher Regional Court. Following W.’s arrest, Germany expelled the Russian intelligence officer allegedly connected to the case. Moscow responded by expelling a German diplomat, escalating the diplomatic consequences of the investigation. The case highlights German concerns about Russian espionage networks and efforts to obtain information or cultivate contacts within the country’s defense and political spheres.
Entities: Ilona W., Russian intelligence officer, Federal Prosecutor's Office of Germany, Russian Embassy in Berlin, Berlin • Tone: analytical • Sentiment: negative • Intent: inform
14-09-2026
German federal prosecutors have charged Ilona W., a 57-year-old Berlin businesswoman who holds both German and Ukrainian citizenship, with conducting intelligence activities for Russia. She was arrested on January 21 and remains in pre-trial detention. The charges were filed before the state security division of Berlin’s Higher Regional Court.
Prosecutors allege that Ilona W. used her professional position to support a Russian intelligence officer stationed at the Russian Embassy in Berlin. She ran a marketing agency and chaired a lobbying association, roles that gave her access to military and political networks. Beginning at least in October 2023, she allegedly provided the officer with information about prominent events and helped him gain entry, sometimes using a false name. Investigators believe these activities were intended to help the officer expand his intelligence network in Germany.
The indictment also accuses W. of attending events to identify useful contacts and potential targets. Prosecutors say she attempted to recruit individuals from Germany’s Defense Ministry and the arms industry, and sought information about German defense policy and the defense sector. The alleged intelligence-gathering was reportedly connected particularly to Russia’s war against Ukraine.
The case has also triggered diplomatic consequences. Germany expelled the suspected Russian intelligence officer linked to the investigation shortly after W.’s arrest. Moscow responded by expelling a German diplomat. The allegations remain accusations, and the article does not report a court verdict.
Entities: Ilona W., Berlin, Germany, Ukraine, Russian intelligence service • Tone: analytical • Sentiment: negative • Intent: inform
14-09-2026
Germany’s Military Counter-Intelligence Service (MAD) has warned that the country faces a worsening threat from hybrid attacks, espionage and sabotage, with Russia identified as a priority source of hostile intelligence activity. The agency’s annual report says Germany’s strategic position in Europe and NATO, the expansion of its armed forces, and the introduction of new weapons systems have made it an increasingly attractive target.
The report highlights several forms of hybrid activity, including cyberattacks, drone operations, attempts to influence political processes, and disruptive attacks against transport networks, energy facilities and telecommunications infrastructure. MAD also warned that surveillance activities targeting military infrastructure may be connected to China, underscoring that the threat comes from more than one foreign power.
A particular concern is the increased use of recruited contract agents, described as low-level agents, to conduct espionage or sabotage. MAD said the potential danger posed by such agents has risen significantly, although the report did not include comparative figures. The agency explained that withholding the data would prevent adversaries from drawing conclusions about Germany’s security vulnerabilities or intelligence assessments.
The report states that Germany’s overall hybrid-threat situation has continued to deteriorate. Its findings reflect broader European concerns about covert operations, attacks on critical infrastructure and foreign attempts to undermine national security. Although the article does not describe a specific attack or identify individual suspects, it presents the intelligence assessment as a warning that Germany must contend with increasingly varied and persistent activities linked to Russia, China and other hostile actors.
Entities: Germany, Military Counter-Intelligence Service (MAD), Russia, China, NATO • Tone: urgent • Sentiment: negative • Intent: inform
