US Charges Russian Intelligence Network in $40,000 Murder-for-Hire Plot Against a Dissident Near Washington
Federal prosecutors in Manhattan on September 15 charged a former Russian intelligence colonel, his FSB officer son and three Latin American recruiters living in Russia with financing terrorism and conspiring to murder a prominent Russian dissident near Washington. The seventeen-page indictment, unsealed the same day, quotes the network’s own messages: $1,000 to $1,500 for a thirty-second surveillance video, $40,000 for the killing, arson across Europe priced by “the intensity of the fire” and “the resonance”. None of the five is in custody; all are believed to be in Russia. One of them, a Cuban dance teacher from Petrozavodsk, kept a map of Warsaw with red marks in his cloud accounts, and Polish counterintelligence has charged the Colombian he is alleged to have coached with two arsons in Warsaw and Radom.
The story the indictment tells begins in Brooklyn.
On July 29, 2026, a Venezuelan man living there received a message from an acquaintance in Russia. Did he have someone in Washington he trusted? The acquaintance, a Venezuelan named Angel Eduardo Castro, twenty-two years old, explained the opportunity in the tone of a man passing along a side gig. Because of his time in Russia, people kept reaching out to him about things located elsewhere. They paid money for pictures of places.
Then Castro forwarded a voice note. It came from a Cuban living in Russia who calls himself Viking, and it was phrased in the vocabulary of a building site: “What’s up with your guy from Washington? I don’t need him to do construction. I need him to measure a plot of land and provide measurements.”
In this network, prosecutors say, construction meant murder. Measuring the plot meant surveillance.
The specifications followed the same day. Photos and video of a particular address, no less than thirty seconds, shot from different angles, and somewhere in the frame a hand with the thumb up, a “key,” as the message put it, evidently to prove the footage had been made to order rather than lifted from the internet. Handlers have to account to their own paymasters, which is why they always want proof of work; the FSB asset who bought a Florida protest movement for seven thousand dollars demanded photographs and head counts for the same reason. “This is gravely serious work,” the message said. The pay for it was $1,000 to $1,500. A further voice note clarified what the address was for. The person living there was someone they “want to eliminate they want to disappear,” and there was “$40,000 for whoever does the work.”
The Brooklyn man replied that he would take pictures if Viking wanted. He would not do “the other stuff.”
That exchange opens the factual heart of the indictment, case 26 Cr. 426, returned by a grand jury in the Southern District of New York on September 15, 2026. It charges five men with conspiring to finance terrorism, and three of them with conspiring to commit murder for hire. What the indictment alleges is untested in any courtroom, the defendants are presumed innocent, and given their address the allegations may stay untested for a long time; the European convictions described further down are a different matter. What the document offers in place of a trial is something rarer: a message-by-message account of how a state intelligence service now purchases violence abroad, at what prices, and with what quality of staff.
For a reader in Warsaw the document has a second layer. One of its exhibits is a map of the Polish capital with red markings. The man who kept that map, the indictment says, also booked hotels in Poland for an arsonist on his way to Prague in June 2024. Polish counterintelligence has since charged a Colombian with setting fire to two depots, one in Warsaw and one in Radom, in May 2024, on the orders of a person it described only as linked to Russian intelligence. That person now appears to have a name, an age and a dance studio. We will come to him.
The cast
Prosecutors call the group the RIS Network, for Russian Intelligence Services, and describe it as one arm of the Russian state’s apparatus for attacks beyond its borders. Three men sit at the top. Yuri Khrameev, 63, “Colonel Yuri,” is described as a former colonel in the Russian intelligence services. His son Kirill, 27, is described as an officer of the FSB, the Federal Security Service, the domestic successor of the KGB, which has never confined itself to domestic work. Oemis Romagoza Durruthy, 35, is a Cuban national and, in the indictment’s phrase, an influential member of the Cuban diaspora in Russia; his department was travel, payments and reconnaissance of targets. Below them work the recruiters: Yaidel Delgado Suarez, 35, the Cuban known as Viking, and Castro, the Venezuelan who knew a man in Brooklyn.
The staffing pattern deserves a moment. Two of the three men at the top are Russian officers; the third is a Cuban. In the American plot, the men who actually touch the freelancer are a Cuban and a Venezuelan living in Russia, and a footnote records that every communication among Castro, Suarez and the Brooklyn recruit took place in Spanish, with the English translations in the indictment described as drafts subject to revision. In the European plot a year earlier the Khrameevs handled the recruit themselves. Russia has reportedly drawn on Cuban nationals as manpower for its war in Ukraine; here the same labor pool turns up in a different department, recruiting for operations in NATO countries and the United States. A service that once ran illegals with decades of cover now recruits in Spanish on Telegram. Western analysts have taken to calling this a gig economy. As I argued after the Dylan Earl trial in London, the label describes the payment method, not the relationship.
Tradecraft, as taught to amateurs
Nothing in the indictment suggests the Brooklyn recruit had any training. Suarez supplied it by message. Put the phone in airplane mode. Hold it in the left hand and record toward the house. Start a block before the neighborhood, then slow down as you pass. Emphasize the house itself. Delete the chat with the photographs and the coordinates. Be “discrete and do it from afar.” And hurry, because the surveillance “has to be today or tomorrow.”
The recruit, for his part, had instincts his handlers lacked. When Castro relayed that Viking wanted his number so they could talk directly, he balked: “Dont’ have him call me. That’s crazy. Can we talk through you so it gets disguised? Otherwise he tells me directly so they can connect the communications. You know they track everything here.” He was right about the tracking. He was wrong about the discipline of the people he was working for. Suarez messaged him directly the same day anyway, and that direct channel is now quoted at length in a federal charging document.
The recruit went out and filmed. Suarez confirmed that Castro had been handed the money for him the moment the videos arrived. Then came the upsell. Did he know “someone who wants to do construction,” or would he be “interested” himself? He said Castro had mentioned it and that he would see if he could find the right people. Suarez’s reply is the most revealing passage in the document, because it is the voice of middle management squeezed from above and let down from below, typos and all in the prosecutors’ draft translation: “Let me know as soon as possible because I have a chain and my boss has questions. I have people in Mexico right now and theyre delayed. I only need a response to know if someone can do the work. It doesn’t have to be today or tomorrow just need to know if the can. Ask [Castro], the money is here.”
A chain, a boss with questions, a subcontractor in Mexico running late, cash released on confirmation. Remove the subject matter and it could be a procurement thread in any firm. The subject matter was the killing of a man near Washington whom the indictment calls Victim-1, a prominent Russian dissident. Both addresses the recruit filmed were later confirmed as publicly associated with him. The document does not name him, and nothing in it invites guessing. The FBI’s Washington Field Office says it moved quickly to disrupt the plot once the threat was identified. Neither the Brooklyn recruit nor the American who appears in the next chapter is named as a defendant. Both are described with the intimacy of people whose phones the government has read; how it came to read them, the indictment does not say.
The Vilnius rehearsal
A year earlier the same network ran the same play in Europe, and it is the European chapter that explains the charging strategy.
On June 24, 2025, an American citizen met Kirill Khrameev at the border between Estonia and Russia. Kirill offered to pay him to travel to an address in Vilnius and photograph it. The American accepted, took the pictures, sent them over an encrypted app, and was promised about $200. Then the son passed him upward to a man he called his boss and a colonel, who appeared under the screen name “Combat Colonel Yuri” and promptly moved the conversation to a second encrypted app.
The screen names deserve their own footnote. In the 2026 messages the indictment renders the colonel’s handle as “Yuri Khrameev [combat],” and in the screenshots it reproduces, forwarded through a Spanish-language phone (“Reenviado de”), the Cyrillic reads, as far as the low resolution allows, ЮРИЙ ХРАМЕЕВ (комбат). Kombat is Russian military shorthand for a battalion commander, komandir batalyona, the sort of thing an old officer puts after his name. The translators appear to have read it as “combat.” Whether the 2025 screen name “Combat Colonel Yuri” rests on the same word the indictment does not say, though it is hard to see what else it would rest on. The document warns that its Spanish translations are drafts; the Russian ones evidently deserve the same warning.
The colonel introduced himself. He said he had worked with Vladimir Putin when they were young. A “bad guy” lived at the photographed address, and the American would receive about $25,000 to kill him. The reason for the sentence was rhetorical: the target was “spreading dirt about my country,” “telling the media and the common people that the Russians are the aggressors,” and “distorting history.” The colonel proposed methods with the brevity of a man who has proposed them before, “throwing a bottle of gasoline” or “sticking a knife” in the victim, sent a photograph of the target, asked that it be deleted after viewing, and promised to resend it nearer the day. He also wanted fresh photographs or video of the residence every two or three days.
The American declined. The location was too open; he saw no way to do it without being caught. The colonel’s response was to lower the tier of service. He offered a “simpler job”: set fire to a warehouse of property or food, or throw a bottle of gasoline at an electrical substation. The fee would depend on “the intensity of the fire,” “the damage,” and “the resonance.” He was interested in military and dual-use facilities in NATO countries, and he listed them like a man reading from a wish list: railway stations, fuel tanks, wagons carrying humanitarian aid to Ukraine, wagons with equipment, bus depots, tram depots, substations, gas stations, industrial premises, any warehouses. The next day he restated the brief: “I am interested in all the countries that are helping Ukraine… You’re looking for such objects yourself. You need to approach it creatively… I’m offering serious money for serious work.”
When that failed too, the register changed. On August 25, 2025, the colonel wrote that the American “shouldn’t miss this opportunity,” and then: “If you are already cooperating with Western intelligence agencies, then as a colonel of Russian intelligence agencies, I will leave this game with dignity… And this could be the biggest mistake of your life. Yes. It’s dangerous.”
Read as evidence, the passage does a great deal of work. Indexing the price of arson to “resonance” is not a stray word. Resonance is the effect on the public, and effect on the public is the core element of the statute the prosecutors chose: an act whose purpose, by its nature and context, is to intimidate a population or compel a government. Prosecutors will still have to prove every element to a jury, but when the customer tells you he pays more for fear, the purpose element comes close to writing itself. The fungibility is as telling. The same handler offered the same freelancer, within days, a murder, an arson or a substation, priced on a sliding scale. A dissident in Vilnius and a warehouse in any allied country were interchangeable line items. What the colonel was running looks less like an assassination program with a sabotage sideline than a procurement desk with a catalogue.
Anyone who has followed Polish news since 2023 will find the catalogue familiar. Railway stations. Wagons with aid for Ukraine. Substations. Warehouses. The colonel was not describing a hypothetical. He was describing the last three years east of the Oder.
The travel agent
Durruthy’s chapter reads like the ledger of a logistics company, which is roughly what prosecutors say he ran.
In June 2024 he paid for and arranged the travel of a man the indictment calls Associate-1 to carry out attacks in Prague. The Czech prime minister has said publicly that those attacks were “very likely” organized and financed by Russia. Durruthy, from inside Russia, sent Associate-1 more than $1,000 in cryptocurrency before the attack, booked hotels for him in Prague and in Poland, through which he traveled on the way to the job and back, and kept screenshots of their conversations in his online accounts. One image, reproduced in the indictment, is a map of Warsaw with routes and markings in red: potential attack sites in the Polish capital. He also kept a video of Associate-1 on what appears to be a practice run for arson, two men discussing directions to a location and using the words “gas,” “oil” and “fire.”
In September 2024 a second attack he coordinated struck a plant in Šiauliai, Lithuania, that makes mobile radio stations for the Ukrainian military. Lithuanian prosecutors have said publicly that the attempted sabotage was carried out on the orders of, and for the benefit of, the GRU, Russia’s military intelligence. Durruthy booked travel for a man later arrested over the attack, arranged his transport inside Lithuania before and after it, and exchanged some 243 communications with another participant, Associate-2, between late October and early December. Durruthy and Associate-2 have both been charged in Lithuania. That case is pending.
Two details tie the European arson campaign to the American murder plot, and both are failures of hygiene rather than feats of detection.
The first is a phone number. In the days around the Šiauliai attack, Durruthy was in touch with Yuri Khrameev, who used the same number that surfaces in the 2026 communications about the Brooklyn recruit. A colonel who shifts his freelancers between apps and tells them to delete photographs kept one number for two years, across two continents and two crimes. It is the failure that undid the FSB-linked hacker of the Void Blizzard case, traced through a PayPal account and one phone number: anonymity online rarely shatters, it leaks through convenience.
The second is a folder. Between November 10 and 26, 2025, Durruthy and the colonel exchanged messages. Files in Durruthy’s online accounts indicate they were taken or saved in that same month: photographs and videos of one of Victim-1’s residences near Washington, including footage of the inside of one of his dwellings. How that interior footage was obtained, the indictment does not say. At least one of the photographs appears to be the very image Suarez sent the Brooklyn recruit in August 2026, which Suarez had received from the colonel. The Washington target, then, was being worked some eight months before anyone in Brooklyn was approached.
A footnote adds the last knot. Between August 27 and September 10, 2026, Suarez exchanged roughly 96 messages with Associate-2, the man charged in Lithuania over Šiauliai. The last of them was sent five days before the grand jury voted. Durruthy, meanwhile, had booked the principals’ own travel in May 2026: the colonel between Minsk and St. Petersburg, Viking between St. Petersburg and Moscow.
The Polish chapter: a map, two depots and a salsa teacher
The indictment never names Associate-1. It gives him a route (Poland, then Prague, then Poland again), a month (June 2024), a payment (over $1,000 in cryptocurrency), a coach (Durruthy) and a rehearsal video. It does not say whether the sites marked in red on the Warsaw map were ever attacked. Polish media, working from the wire copy, have reported the map and left the question open.
The question can be closed further than that, by reading three documents side by side.
The first is the Czech judgment. On June 9, 2025, the Prague City Court sentenced a Colombian, Andrés Alfonso de la Hoz de la Cruz, to eight years for setting fire to three buses at a Prague depot and planning another arson, having received his orders on Telegram against a promise of $3,000. He filmed his work and left. The Czech prime minister had said from the start that the case was likely part of Russia’s hybrid war.
The second is the Polish charge sheet. In July 2025 the Internal Security Agency, the ABW, announced that the same Colombian had, before Prague, set fire to two construction supply depots in Poland, in Warsaw on May 23 and in Radom on May 30, 2024, on Russian orders. He was charged with an act of a terrorist character and, in the ABW’s words, faces ten years to life. The agency said the arsons had been commissioned, supervised and financed by a person linked to Russian intelligence, who supplied the target, the method, down to the recipe for the incendiary bottle, and the means of transport. It added a finding of general application: Russian services had been systematically recruiting Latin Americans with military backgrounds through Telegram to reconnoitre locations, set them alight and document the damage, with the footage later recycled by Russian-language media, the same web of mirror sites and “alternative” channels that keeps banned Russian media alive online despite the EU broadcast ban. The person who commissioned the fires was not named.
The third is the American indictment, together with what was said around it. U.S. authorities have described the Prague participant Durruthy enlisted as a Colombian who tried to burn public buses, according to Radio Free Europe’s account of the case. The indictment itself supplies the Polish hotels, the crypto payment, the coaching and the Warsaw map.
Lay the three over one another and the unnamed “person linked to Russian intelligence” in the ABW’s statement acquires a face. A joint investigation by Lithuanian public broadcaster LRT, Deutsche Welle and Czech public television, published in Lithuanian on September 14, 2026, and in English two days later, fills in the biography. Durruthy ran a salsa and bachata studio called “Made in Cuba” in Petrozavodsk, married a Russian woman in 2022, and recruited through Telegram and Facebook groups under names such as “Dios,” “Adrian” and “Zans Adrian.” Among the groups where he posted job offers were ones called “Latinos en Polonia/Trabajo en Polonia,” “Polsha Chat” and “Rabota v Polshe.” The journalists established that de la Hoz, a former Colombian soldier looking for work in Europe, carried out the Warsaw and Radom attacks on instructions from accounts belonging to “Dios” or “Adrian,” then travelled to Prague. Lithuania has had an international arrest warrant out for Durruthy since January 2026, when it sent six of his alleged recruits to trial over Šiauliai; its prosecutors said even then that the same group had targeted warehouses in Poland.
Two cautions belong here. The indictment does not name de la Hoz, and no court has found that Durruthy commissioned the Polish fires; the ABW has charged the man with the matches, not the man with the map, and nothing published so far shows that the red marks on that map are the two depots that actually burned. But the convergence is close enough that the burden of explanation has moved. If Associate-1 is not de la Hoz, then Durruthy financed a second Colombian who also set fire to a bus depot in Prague in June 2024 after also passing through Poland, and Czech prosecutors have somehow overlooked him.
For Poland this changes the shape of the case. Until this week the Polish file had a perpetrator and a shadow. Lithuania had given the shadow a name in January; the journalists gave it a biography on Sunday; the American grand jury has now given it a place in a state-directed conspiracy that runs from Prague to Washington, with the Warsaw map as an exhibit. Poland was not only a target on this network’s map. It was its recruitment pool: the same groups where Latin American migrants look for warehouse shifts in Poznań were where a man in Petrozavodsk looked for people with “military experience” who could travel within Schengen.
It also fits a pattern Polish courts already know. In December 2023 a court in Lublin convicted fourteen members of a sixteen-strong network, recruited through Telegram for small sums, for placing cameras along railway lines carrying aid to Ukraine and preparing sabotage on behalf of Russian intelligence; the remaining two were convicted later. In May 2025 the Polish prime minister said the fire that destroyed the Marywilska shopping centre in Warsaw a year earlier had been arson ordered by Russian services and coordinated by a person in Russia. In November 2025 an explosion on the railway line toward Lublin was attributed by the Polish government to Russian services acting through two Ukrainians who fled to Belarus. The colonel’s wish list, railway stations, wagons with humanitarian aid, warehouses, substations, reads like an index to that period. He was not inventing. He was ordering from a menu his colleagues had already tested.
Polish law has moved to meet this. The 2023 amendment to Article 130 of the Penal Code treats sabotage, diversion and terrorist offences committed for a foreign intelligence service as espionage at its most serious; that is Article 130 § 7, and it is the source of the ten years to life the ABW cited for a Colombian with a bottle of petrol. Organisers are reached through the same article’s provisions on directing intelligence activity and through the ordinary rules on complicity. Whether Polish prosecutors have, or will, use them against the man with the map is a question the American indictment has now made impossible to leave unasked.
What the lawyers should notice
Six features of the charging document reward a professional reading.
The first is the choice of statute. Count One is not the familiar material support charge under 18 U.S.C. § 2339B, which requires a designated foreign terrorist organization, nor § 2339A, which requires support for one of a list of enumerated federal crimes. It is § 2339C, the provision that implements the 1999 UN Convention for the Suppression of the Financing of Terrorism, in the branch (§ 2339C(a)(1)(B)) that punishes providing or collecting funds with the intent or knowledge that they will be used for an act meant to cause death or serious injury to civilians, where the purpose of the act is to intimidate a population or coerce a government. It needs no designated organization and no listed predicate. It reaches a colonel who pays $200 for photographs in Vilnius as easily as a recruiter who pays $1,500 for a video in Washington, and a travel agent who books a hotel in Poland for an arsonist. That is why the count can span Prague, Šiauliai, Vilnius and the American capital, run from 2024 to September 2026 “in Russia, Estonia, and elsewhere,” and name all five men.
The second is who is missing from Count Two. Only Yuri Khrameev, Suarez and Castro are charged with murder-for-hire conspiracy under § 1958, and the count is confined to the American plot of July to September 2026. Kirill Khrameev and Durruthy are not in it, although the son recruited the Vilnius photographer and Durruthy held the Washington target’s photographs. The indictment does not explain the omission. The likeliest reading is statutory: § 1958 requires intent that a murder be committed in violation of the laws of a State or of the United States, and a killing in Lithuania of a man the indictment does not describe as an American national is not an obvious fit, while Durruthy’s part in the Washington plot is proved through files rather than through messages to the recruit. The prosecutors charged what the evidence comfortably carries and stopped there, which is what one wants prosecutors to do.
The third is venue. Brooklyn, where the recruit lived, lies in the Eastern District of New York. The addresses he filmed lie near Washington. Yet the case sits in Manhattan. The answer is 18 U.S.C. § 3238, cited in both counts, which assigns the trial of offenses committed outside any district to the district where the offender is arrested or first brought. The indictment states that at least one defendant “is expected to be first brought to and arrested in the Southern District of New York.” That is the government’s pleaded theory, not a ruling; the same section would also have allowed filing in the district of a joint offender’s last known American residence or, failing that, in the District of Columbia. Venue rests, in other words, on an arrest that has not yet happened. Manhattan prosecutors have used this hook before to receive defendants delivered from abroad. Here it is a promissory note.
The fourth is the arithmetic of penalties. Conspiracy to finance terrorism carries up to twenty years. Murder-for-hire conspiracy, where no injury results, carries up to ten. The count with murder in its name is the lighter one; the count built on payments of $200 and $1,500 is the heavier. Practitioners will follow the logic. Lay readers will not, and the indictment is written for both.
The fifth is forfeiture. For Count One the government invokes § 981(a)(1)(G), the terrorism forfeiture provision, and demands “any and all assets, foreign and domestic, of the defendants.” The demand is not confined to proceeds or instrumentalities; it is the whole estate, with a substitute assets clause to follow the value wherever it goes. An indictment forfeits nothing; a conviction on Count One would trigger it. Against five men in Russia the yield is doubtful. The signal matters more than the yield. The statute treats a person engaged in terrorism against the United States as someone whose entire fortune is forfeit, and the government has now said in a charging document that it regards officers of Russian intelligence as such persons.
The sixth is the least technical and the most consequential. Paragraph 3 of the indictment is a history lesson: Klebnikov in Moscow in 2004, Litvinenko and polonium in London in 2006, the Skripals and Novichok in Salisbury in 2018, Khangoshvili in Berlin in 2019, Navalny’s death in custody in 2024 and, as recently as this month, a German investigation linking the GRU to the foiled drone attack on a Ukrainian aircraft at Leipzig/Halle airport. None of this is an element of any offense. It is there to plead context, because § 2339C speaks of purpose “by its nature and context,” and because the prosecutors want the court and the public to read the RIS Network not as five freelancers but as “one arm of the Russian Federation’s apparatus.” Defense counsel, should any defendant ever appear, can be expected to move to strike it as surplusage under Rule 7(d). Until then it functions as a speaking indictment in the fullest sense: the Department of Justice, on the record, describing the conduct of a permanent member of the UN Security Council as state terrorism, with footnotes.
Three courts, one pyramid
Set the European and American cases side by side and a pyramid appears, upside down.
At the bottom sit the people who held the bottles: a Colombian serving eight years in a Czech prison who also faces the Polish charge, and six foreign nationals on trial in Šiauliai. They were paid a few thousand dollars, or promised it. They filmed themselves. In Šiauliai, by their lawyers’ account, the defendants say they were told they were frightening a business competitor.
In the middle sit the coordinators: Durruthy with his hotel bookings and his map, Suarez with his voice notes, Castro with his Brooklyn contact. Lithuania has a warrant for Durruthy. America has an indictment for all three. Nobody has them.
At the top sits whoever Suarez meant when he wrote that his “boss has questions.” It may be the colonel himself, who was feeding Suarez the addresses; it may be someone above the colonel. The indictment does not say, and neither does anyone else.
The European courts have the bottom of the pyramid in custody and are punishing it severely: eight years in Prague, a charge carrying ten to life in Warsaw, trials pending in Lithuania. The American court has the middle on paper and the top in a quotation. This is not a criticism of any of them. Each charged what it could reach. But it describes the strategic result of the franchise model exactly. The state that designed it bears no cost that a court can impose, the intermediaries bear the cost of never travelling west again, and the freelancers bear everything else. Deterrence, in this arrangement, is aimed at the cheapest component.
The economics of deniability
Set the price list side by side. Two hundred dollars for photographs of a door in Vilnius. Three thousand dollars, promised, for three buses in Prague. Between $1,000 and $1,500 for thirty seconds of video near Washington, thumb in frame. Twenty-five thousand dollars for a life in Lithuania. Forty thousand for a life in America. A fire priced by its resonance. At the bottom of the pyramid the money is small, and it is tempting to conclude what Western analysts concluded in 2024: that Moscow now runs on disposable agents, hired for a day and forgotten. I have argued before, on the evidence of the Dylan Earl trial in London, that the disposable agent is a myth, and this indictment is a second witness for the prosecution. The cheap end of the price list is an entry fee, not a valuation.
Look at how the network treats people once it has them. The colonel spent two months on one reluctant American: photographs first, then a murder, then a menu of arsons, then a threat, each step a test and a correction, none of them a dismissal. Suarez paid the Brooklyn recruit for his video and immediately asked him to become a recruiter himself. Durruthy, who began by booking a Colombian’s hotels in 2024, was holding reconnaissance of a Washington dissident’s home by late 2025 and arranging the colonel’s own travel by 2026. And a man charged in Lithuania over Šiauliai exchanged 96 messages with Suarez in the two weeks before the grand jury voted. Discarded agents do not get 96 messages. What the low prices describe is not disposal but a funnel: many are tried at $200, some are kept at $1,500, a few are developed into the men who book the hotels. It is the pattern the KGB ran with shortwave radios; only the app has changed.
The logic of the funnel is coherent. A recruit found on an encrypted app and paid in crypto cannot be traced back to a ministry the way a diplomat can. If he fails, he is a Venezuelan with a phone. If he talks, he knows only Castro, who knows only Viking, who knows only a boss with questions. That is the theory of the chain, and the chain is built to break cleanly at every link.
The indictment shows what the theory leaves out. Freelancers keep screenshots; the Warsaw map survived in a cloud account. Middle managers reuse phone numbers, because changing them is inconvenient and the risk was meant to sit with the freelancers. Recruiters on a deadline message the recruit directly even after being asked not to, because the boss has questions and Mexico is delayed. A colonel who tells one foreigner to delete a photograph keeps another in circulation for nine months, until it turns up both in his logistics man’s archive and in a Brooklyn chat. A dance teacher runs a terror logistics business from accounts that also advertise his studio. A model designed to spare the state its own fingerprints ends up documented at a level of detail no traditional operation would have tolerated, because traditional operations were run by professionals, and professionals do not narrate their work to strangers in voice notes.
For Europeans, and for Poles in particular, one image in the document lingers: the map of Warsaw with the red marks. It appears in an American indictment about an American murder plot, as an exhibit in the chapter on a Cuban travel agent, and it now sits beside a Polish charge sheet for two fires in May 2024 and a Lithuanian wanted notice for the man who sent it. Nobody in this network seems to have distinguished very carefully between a depot in Radom, a radio plant in Lithuania, a dissident in Vilnius and a dissident near Washington. The colonel said so himself. He was interested in all the countries helping Ukraine, and he asked his contractors to approach the matter creatively.
Whether the five ever see the inside of a Manhattan courtroom depends on their travel habits; Russia does not extradite its citizens, so American warrants have learned to wait for a plane ticket, and Durruthy at least has shown that he books tickets with care. Until then the document stands as what its authors intended: a public account, drawn from the participants’ own words, of how the Russian state currently shops for violence. The colonel priced his fires by resonance. He may yet learn that indictments are priced the same way.
Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.
The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.
Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.
He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.
Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.
Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.
He believes that the best legal advice is the kind that means the client never has to appear in court.
