According to the report, Durruthy used the aliases "Adrian" or "Dios" (Spanish for "God") and posted job listings on Telegram channels — for example, advertising work as a photographer in Poland. He also actively placed ads in groups for Cubans living in Russia and for other Latin Americans.
"We need people with military experience in surveillance, reconnaissance, logistics and tactical maneuvering," one of the Spanish-language ads read. It also promised payment of $1,500 plus a bonus for each completed operation, DW reported.
The investigation found that "Dios" recruited people to carry out sabotage on Russia's behalf in at least four EU countries. Most of those he recruited came from Spanish-speaking countries.
"Over several months, DW and its partners conducted dozens of conversations with intelligence officials and people close to the suspects," the outlet reported.
“By cross-referencing secret court documents, official statements, social media posts and leaked data, journalists identified who ‘Dios’ is and reconstructed how he built a network of saboteurs to carry out arson attacks across Europe. However, not all of them managed to complete their assigned tasks.”
After reviewing sealed court documents and dozens of leaked files, DW and its partners were able to confirm that the person behind the alias "Dios" is Cuban citizen Oemis Romagoza Durruthy.
He is originally from Camagüey, Cuba's third-largest city, and has lived in Russia for at least seven years.
"Durruthy teaches Latin American dance in Petrozavodsk, in northern Russia, and is listed as a contact person on the social media pages of the local dance studio Made in Cuba," DW reported. “In numerous videos of his classes, he demonstrates salsa, bachata, and kizomba moves.”
In 2022, Romagoza married a Russian woman, later obtained Russian citizenship and had children.
DW was unable to determine when or under what circumstances he began working for Russian intelligence services. According to leaked data, Romagoza may have faced financial difficulties. In 2023, he took out loans from several lenders; on one application, he listed a supermarket chain as his employer, the outlet reported.
Durruthy did not respond to DW's requests for comment.
One of the Latin Americans recruited by "Dios," according to the investigation, was 34-year-old Colombian former soldier Luis Alfonso Murillo.
"In early 2024, Murillo decided to join the Ukrainian army, where foreign fighters can earn several thousand euros a month fighting on the front line, according to court records," DW reported.
While looking for a way to get to the front, he joined a Facebook group for Latin Americans who wanted to fight in Ukraine. That's when he was contacted by someone using the alias "Dios," who, according to the outlet, offered him "special tasks" in Europe instead of going to Ukraine.
Murillo accepted the offer, and Dios arranged everything — flights, accommodation, ground transportation — remotely. The two never met in person.
"When Murillo arrived in Bucharest in July 2024, Dios sent him a satellite image marking a waste-processing facility and an oil well," the outlet reported.
“Murillo was supposed to photograph and film these sites, then set them on fire. However, he was detained at night near the waste-processing facility, after he had already taken the photos. According to case files, Murillo told investigators he had no intention of committing arson. He said he was trying to get to Europe in order to eventually reach Ukraine, and that he didn't know who he was working for.”
DW and its partner outlets were able to confirm that Murillo was one of at least 10 people recruited by "Dios" to carry out sabotage across Europe.
"Such recruits are often called 'disposable agents'," the journalists wrote.
“They are usually hired online and sometimes don't even know the faces of those who hired them, or the real purpose of the tasks assigned to them.”
DW also confirmed that over a four-month period in 2024, "Dios" directed his recruits to set fire to a construction-materials warehouse in Poland, a bus depot in the Czech Republic, a waste-processing plant in Romania, and Lithuanian-made equipment intended for Ukraine.
Lithuania's prosecutor's office was the only agency to publicly link this series of arson attacks to Russian military intelligence.
"In 2024 alone, these 'disposable agents' set fire to a shopping center in Poland and an Ikea store in Lithuania, and sent packages containing incendiary devices that exploded at logistics centers in several countries," the outlet reported.
“German authorities said that in August, such agents directed an explosive-laden drone at a Ukrainian cargo plane in Leipzig.”
European authorities continue to search for Romagoza, who may still be in Russia. In April 2026, the Made in Cuba studio posted a video online showing him teaching a salsa class. In the video, the Cuban stood facing a mirror, leading a group of women who mirrored his movements and followed his commands.
"That's how I am. In heaven, I'm the one in charge," he says, as a Cuban song plays in the background.
Recent sabotage incidents in Europe
Aug. 4, Germany — The first drone was discovered at Leipzig airport.
Aug. 10, Bulgaria — A large fire broke out at a plant belonging to defense company EMCO. Preliminary information suggested a cargo truck caught fire while refueling.
Aug. 13, Italy — A fire and powerful explosion occurred at the KNDS Ammo Italy facility near Rome.
Local prosecutors are examining the possibility of outside interference. Publicly, prosecutors have only confirmed that a case was opened over causing a disaster through negligence, involving "unidentified persons."
Aug. 15, Estonia — A fire broke out at the Milrem Robotics plant in Tallinn, which, according to the Kyiv Post, supplies drones to Ukraine. Two suspects were detained.
Estonian Prime Minister Kristen Michal said investigators are "seriously considering" the possibility of Russian sabotage.
Aug. 25, Slovakia — Police said they prevented an arson attack at a Ukrainian drone manufacturer's facility and seized a "large quantity of incendiary mixture." The company itself blamed Russia, and police detained three suspects who, according to police, "acted on instructions." Slovakia is a close ally of Russia in Europe.
Aug. 30, Poland — A country frequently targeted by sabotage, Poland reported two more fires.
One occurred at a facility in Lublin that manufactures helicopter components. Prime Minister Donald Tusk said arson "cannot be ruled out."
An attack on drone manufacturer WB Group also showed clear signs of deliberate arson. Surveillance cameras captured a masked man throwing incendiary devices. Tusk called it "a continuation of Russia's escalatory activity."
The campaign continued into September: two Bulgarian nationals were detained in Munich on suspicion of arson. According to investigators, they threw incendiary devices from a car at the Rohde & Schwarz defense facility.
German media, citing a federal police report, reported more than 165 suspected sabotage incidents across the country this year, though the report did not specify who is responsible for them.