Full Report
The United States has charged two Russian nationals, two Cubans, and one Venezuelan with working for Russian intelligence to prepare assassination attempts in…
Analysis Summary
# Incident Report: Russian Intelligence Assassination and Sabotage Plot
## Executive Summary
The U.S. Department of Justice has unsealed charges against a five-member network managed by Russian intelligence (FSB) for plotting assassinations of Russian dissidents on U.S. and European soil. The network utilized Russian nationals alongside Cuban and Venezuelan proxies to recruit local assets for surveillance, murder-for-hire, and sabotage of critical infrastructure. While the suspects remain at large, the unsealing of the indictment represents the first documented attempt by Russian intelligence to conduct a state-sponsored killing within the United States.
## Incident Details
- **Discovery Date:** Summer 2024 – September 2026 (Unsealed)
- **Incident Date:** June 2024 – September 2026
- **Affected Organization:** Russian Dissident Groups; Western Critical Infrastructure
- **Sector:** Government / Political / Energy & Logistics (Infrastructure)
- **Geography:** USA (Washington), Lithuania, and Czechia
## Timeline of Events
### Initial Access
- **Date/Time:** June 2024
- **Vector:** Human Intelligence (HUMINT) / Proxy Recruitment
- **Details:** The network initiated operations in Europe, with Cuban national Oemis Romagoza Durruthy coordinating a sabotage attack in Czechia.
### Lateral Movement
- **Recruitment Expansion:** The network leveraged Venezuelan nationals living in Russia (e.g., Angel Eduardo Castro) to contact and recruit expatriates living in the U.S. via social connections and common nationality to minimize suspicion.
### Data Exfiltration/Impact
- **Surveillance:** Recruits took photos and videos of dissidents' residences in Washington and Lithuania.
- **Sabotage:** Attempts were made to recruit assets to attack electrical substations and food/property warehouses to disrupt countries supporting Ukraine.
### Detection & Response
- **Discovery:** Multi-year investigation by the U.S. Department of Justice and National Security Division.
- **Response Actions:** U.S. DOJ unsealed charges for conspiracy to finance terrorism and murder-for-hire; identification of the FSB handlers (Khrameev family).
## Attack Methodology
- **Initial Access:** Social Engineering/HUMINT; recruitment of foreign nationals via trusted ethnic or social networks.
- **Persistence:** Continuous communication via coded language (e.g., "construction" for murder, "measuring land" for surveillance).
- **Privilege Escalation:** N/A (Physical security context).
- **Defense Evasion:** Use of proxies (Cuban/Venezuelan nationals) to distance Russian intelligence from direct operational activity; use of coded terminology in communications.
- **Credential Access:** N/A.
- **Discovery:** Physical reconnaissance of victims' residences and infrastructure targets.
- **Lateral Movement:** Expansion of the recruitment network from Europe to the United States.
- **Collection:** Video and photographic surveillance of "Victim-1" and "Victim-2."
- **Exfiltration:** Transfer of surveillance data to FSB handlers in Russia.
- **Impact:** Planned kinetic violence (stabbing, arson, arson of electrical grids, and murder).
## Impact Assessment
- **Financial:** Proposed murder-for-hire payments ranged from $25,000 to $40,000.
- **Data Breach:** Compromise of the physical locations and security posture of high-profile political dissidents.
- **Operational:** Disruption of Russian intelligence operations in the U.S.; potential sabotage of European infrastructure prevented or mitigated.
- **Reputational:** Significant escalation in geopolitical tensions; first formal charge of Russian state-sponsored assassination attempts on U.S. soil.
## Indicators of Compromise
- **Behavioral Indicators:**
- Recruitment of non-professional assets for "simple jobs" like photography of residential addresses.
- Coded requests involving "construction" or "measuring land" in non-construction contexts.
- Offers of large sums of cash ($20k+) for violent acts or sabotage.
## Response Actions
- **Containment:** U.S. Department of Justice publicly identified the operatives to burn their operational utility.
- **Eradication:** Indictment of five individuals: Yuri Khrameev, Kirill Khrameev, Oemis Romagoza Durruthy, Yaidel Delgado Suarez, and Angel Eduardo Castro.
- **Recovery:** Ongoing monitoring of dissidents ("Victim-1" and "Victim-2") and infrastructure protection.
## Lessons Learned
- **Key Takeaways:** Russian intelligence is increasingly using "disposable" third-party nationals (proxies) to conduct high-risk kinetic operations in the West to maintain plausible deniability.
- **What could have been done better:** Earlier identification of the recruitment pipeline between South American nationals living in Russia and their expatriate counterparts in the U.S.
## Recommendations
- **Physical Security:** High-profile dissidents should be provided with enhanced counter-surveillance training and residential security assessments.
- **Vetting:** Increased scrutiny of financial transfers and recruitment activities targeting foreign nationals from countries aligned with Russian interests.
- **Awareness:** Public awareness campaigns regarding the tactics of foreign intelligence services recruiting via social media or community networks for "simple tasks."