US Indictment Exposes Russian Intelligence Proxy Network Behind European Sabotage and US Assassination Plot

The five defendants named by the Southern District of New York are all at large. They include former Russian intelligence colonel Yuri Khrameev, his son Kirill, described as an active FSB officer, Cuban national Oemis Romagoza Durruthy, and Cuban and Venezuelan recruiters Yaidel Delgado Suarez and Angel Eduardo Castro.

The indictment describes activity dating back at least to 2024. What emerges is less a conventional espionage operation than a distributed system in which intelligence officers can sit several layers away from the people carrying out surveillance, arranging logistics or attempting acts of violence.

That distance is the point.

From officers to intermediaries

The network described by US prosecutors reflects a significant adaptation in how Russian intelligence can conduct operations in Western countries after the invasion of Ukraine.

The expulsion of hundreds of Russian intelligence officers operating under diplomatic cover removed a traditional operational channel. Officers accredited to embassies were exposed to surveillance and, once expelled, could no longer easily return to the countries where they had worked.

The model described in the indictment reduces that exposure. Instead of sending an intelligence officer to approach a target directly, the system can place several intermediaries between the state and the person performing the task.

Durruthy, who lived in Petrozavodsk, Russia, allegedly handled logistics for European operations. Suarez and Castro recruited people in North America. Behind them were the Khrameevs, including Kirill, an FSB officer, and Yuri, a former Russian intelligence colonel.

At the bottom of the chain were people with little apparent connection to intelligence work.

A US resident in Brooklyn was allegedly paid between $1,000 and $1,500 to photograph and film locations associated with a Russian dissident living near Washington. The material was then passed back through the network. When the same recruit was offered $40,000 to make the dissident “disappear”, he refused. The recruiters then sought alternative assassins, including a team in Mexico.

The FBI intercepted the operation before the killing could take place.

The financial architecture is revealing. Surveillance could be outsourced for hundreds of dollars. A lethal assignment could command tens of thousands. The state did not need to maintain a large permanent apparatus inside the target country if it could find people willing to perform individual tasks.

The same machinery reaches Europe

The US case becomes more consequential when placed alongside the network's alleged European activity.

In 2025, Kirill Khrameev allegedly recruited a US citizen near the Estonian-Russian border to photograph the residence of another Russian dissident in Vilnius. The payment was $200. After the surveillance, Yuri Khrameev allegedly offered the recruit $25,000 to kill the target by stabbing or arson.

When that proposal was rejected, the requested violence shifted from an individual to infrastructure. According to the indictment, Khrameev offered arson assignments against food warehouses or electrical substations in countries supporting Ukraine.

A similar pattern appears in the network's alleged activity in Lithuania.

In September 2024, Durruthy allegedly coordinated two arson attempts against TVC Solutions in Šiauliai, a company producing radio-spectrum analysis equipment for the Ukrainian military. The attacks caused localised fire damage and failed to destroy equipment worth more than €1.5mn.

Other alleged operations involved reconnaissance and logistics in Czechia, Poland and Romania. In Prague, Durruthy allegedly transferred more than $1,000 in cryptocurrency, arranged hotel accommodation and supplied potential targets, including public transport depots.

The significance is not that every operation had the same objective. It is that the infrastructure for recruiting, financing, surveilling and directing operatives could be reused.

A dissident and a military supplier become different targets within the same operational economy.

Why outsourcing changes the risk calculation

Traditional intelligence operations depend heavily on trained personnel. That provides expertise but creates a vulnerability: professional officers are identifiable, monitored and difficult to replace.

Proxy operations reverse the equation.

A person recruited for one task does not necessarily need to know who ultimately ordered it. A recruiter can be separated from the intelligence officer. A logistics coordinator can operate from another country. Payments can be made in cryptocurrency. A recruit can be approached through ordinary social or messaging channels rather than established clandestine infrastructure.

The resulting chain is harder to map from any single arrest.

It is also cheaper to lose.

The people most exposed to prosecution are often the people furthest from the state directing the operation. The five defendants in the US case face serious federal charges, including conspiracy to finance terrorism. Three also face charges related to conspiracy to commit murder for hire. Yet the principal operators identified in the indictment remain beyond the reach of US custody.

That imbalance is an inherent feature of the model.

The expendable agent absorbs the operational and legal risk while the intelligence service preserves distance from the act.

Assassination and sabotage converge

The most important feature of the case is therefore not the nationality of the recruits or the individual plots. It is the convergence of two forms of coercion that have traditionally been treated as separate problems.

The alleged targeting of Russian dissidents represents transnational repression: extending political pressure beyond Russia's borders to people who have become opponents or critics abroad.

The attacks on companies supplying Ukraine represent a different objective, aimed at disrupting the material infrastructure supporting Ukraine's war effort.

Operationally, however, the requirements overlap. Both need surveillance. Both need people willing to act for money. Both require logistics and communications. Neither necessarily requires the person at the bottom of the chain to understand the full strategic purpose of the operation.

That makes the proxy architecture more flexible than a system organised around separate intelligence departments and clearly defined missions.

A network capable of recruiting someone to photograph a dissident's home can potentially recruit someone to inspect an industrial facility. A recruiter looking for a person prepared to commit arson does not need to know whether the target is a warehouse, an electrical installation or a defence supplier.

The task can change while the machinery remains intact.

The attribution problem

The involvement of Cuban and Venezuelan nationals adds another layer of complexity.

The network described by prosecutors does not depend on Russian citizens appearing at every stage of an operation. Recruiters and intermediaries can be foreign nationals operating in Russia or elsewhere, while the people performing individual tasks may have no formal connection to Russia at all.

For Western law enforcement, this creates a wider attribution chain. Establishing that a person committed an act is one question. Establishing who recruited them, who financed them and who ultimately directed the operation is another.

The defendants' presence also matters. The principal operators are based in Russia, a jurisdiction without a US extradition treaty. An indictment can expose their alleged roles and restrict their ability to travel, but it does not by itself put them in federal custody.

That leaves law enforcement with a problem that arrests alone cannot solve.

The new counterintelligence target

The US investigation shows that conventional counterintelligence still has considerable value. The FBI and other US agencies disrupted the Washington assassination plot before it reached its intended target, while the wider investigation has connected activity in North America with operations across several European countries.

But the network also illustrates why preventing individual attacks is becoming only one part of the task.

The harder objective is to identify the architecture connecting apparently unrelated crimes: a small payment for photographs, a cryptocurrency transfer, a hotel booking, an attempted warehouse fire, surveillance of a dissident and an offer of money for murder.

Each action can look minor in isolation.

Together, they form an operational chain in which the state can delegate violence without necessarily placing its own officers near the target.

For European security services, that shifts the focus from identifying foreign spies to identifying the recruiters, intermediaries and financial mechanisms that allow intelligence services to operate without them. For the US, the Washington case shows that this model is no longer confined to European infrastructure or Russian dissidents abroad.